Velocity-Template-Language

Floci API Gateway VTL RCE + IAM Scope Bypass

Floci evaluates user-controlled API Gateway integration response templates with an unrestricted Apache Velocity engine that exposes $util, allowing template code to reach java.lang.ProcessBuilder via reflection and execute arbitrary OS commands in the Floci…