FIX Mitigate Jinja2 Server-Side Template Injection (SSTI) vulnerability

[romanlutz]

Problem

PyRIT's template rendering in seed.py used an unsandboxed Jinja2 Environment, and 21 of 30 remote dataset loaders passed fetched data directly into SeedPrompt(value=...) without escaping. Since SeedPrompt.__post_init__ renders self.value as a Jinja2 template, a poisoned remote dataset could achieve Python object traversal (e.g. "".__class__.__mro__[1].__subclasses__()) — confirmed via proof-of-concept.

The 9 loaders that did wrap values in {% raw %}...{% endraw %} were also bypassable via {% endraw %} injection in the payload.

Changes

Layer 1 — Sandbox the rendering engine (seed.py)

• Replace Environment() / Template() with SandboxedEnvironment from jinja2.sandbox
• Blocks __class__, __mro__, __subclasses__() and other unsafe attribute access
• All 40+ call sites across converters, scorers, and attack executors are covered since they all funnel through render_template_value / render_template_value_silent

Layer 2 — Escape untrusted data in remote dataset loaders

• Add escape_jinja_template_syntax() helper in remote_dataset_loader.py
• Replace all 31 inline f"{{% raw %}}...{{% endraw %}}" patterns with the helper
• Ensures future loaders have a discoverable, consistent function to call

Layer 3 — Eliminate supply chain risk in many-shot jailbreak

• Vendor the many-shot jailbreaking dataset (400 examples, ~664KB) locally as pyrit/datasets/jailbreak/many_shot_examples.json - The dataset was provided by @KutalVolkan originally. For simplicity, we're including it here as well.
• Replace runtime requests.get() from GitHub URL with local json.load()
• Rename fetch_many_shot_jailbreaking_dataset → load_many_shot_jailbreaking_dataset

Regression tests

• test_render_template_value_blocks_ssti_via_endraw_injection — verifies sandbox blocks {% endraw %} escape attack
• test_render_template_value_silent_blocks_ssti_via_endraw_injection — same for the silent rendering path

Testing

• 2760+ unit tests pass (models, datasets, converters, executors, scorers, scenarios)
• All pre-commit hooks pass (ruff, mypy, etc.)
• Manual verification: SSTI payload returns SecurityError with sandbox, executes without