DevSpace Profile Studio — User Customization & Bio SSTI (Jinja2)

Profile Personalization Settings

Template Tags: {{user.name}} {{user.role}} {{user.company}} {{user.reputation}}

Display Name

Username / Handle

Role / Job Title

Organization / Company

Location

Personal Website / Portfolio

Custom Status Greeting Banner Jinja2 Evaluated

Displayed right underneath your avatar on public cards. Supports dynamic Jinja2 expressions like {{user.skills}}.

Public Bio / About Me (Dynamic Markup & Template) Jinja2 Rendered

HTML & Jinja2 template formatting supported. Personalize your bio with profile context variables.

<div class="bio-intro">
  <p>👋 Hello! I am <strong>{{user.name}}</strong>, working as <strong>{{user.role}}</strong> at <strong>{{user.company}}</strong> based in {{user.location}}.</p>
  <p>Specializing in cloud workload defense, container escape mitigation, and automated policy enforcement. Currently holding <strong>{{user.reputation}}</strong> community reputation score.</p>
  <div class="bio-skills mt-3">
    <span class="badge bg-primary bg-opacity-25 text-primary border border-primary border-opacity-50 me-1">Python</span>
    <span class="badge bg-primary bg-opacity-25 text-primary border border-primary border-opacity-50 me-1">Kubernetes</span>
    <span class="badge bg-primary bg-opacity-25 text-primary border border-primary border-opacity-50 me-1">Cloud Security</span>
    <span class="badge bg-primary bg-opacity-25 text-primary border border-primary border-opacity-50">DevSecOps</span>
  </div>
</div>

Backend: Python 3.12 (Jinja2 Renderer)

Live Public Profile Card Preview

How SSTI occurs here:

When users customize their Status Greeting or Public Bio, some platforms inadvertently compile the string through a server-side template engine (Jinja2) rather than treating it as static text.

Try testing: {{7*7}} or {{user.skills}} or Python introspection payloads!

Account Settings & Public Profile Customizer

Profile Personalization Settings

Live Public Profile Card Preview

Sophia Chen