Dojo challenge #31 winners!

This write-up analyzes a Server‑Side Template Injection (SSTI) in Dojo Challenge #31 where a double render and inadequate input filtering allowed an attacker to bypass restrictions using Unicode escapes (e.g. \N{DOLLAR SIGN}) to produce a $ character, inject Jinja-style ${...} expressions, enumerate globals/builtins, import the os module, and execute popen('env') to retrieve environment variables and the flag; the report includes a full PoC payload, risk assessment (confidentiality/integrity/availability), and remediation recommendations (remove the second render or strengthen regex filtering).