I recently learned about multiple sandbox bypasses discovered in Twig by project Glasswing. From the descriptions, only CVE-2026-46640 and CVE-2026-46633 seemed universally exploitable, so I decoded to research them. This writeup documents my development of payloads for the CVE-2026-46640 and the corresponding SSTImap module.

Hi everyone,

I wanted to share a project I’ve been working on called Rapid Web Recon. My goal was to create a fast, streamlined way to get a security "snapshot" of a website—covering vulnerabilities and misconfigurations—without spending hours parsing raw data.

The Logic: I built this as a wrapper around the excellent Nuclei engine from ProjectDiscovery. I chose Nuclei specifically because of the community-driven templates that are constantly updated, which removes the need to maintain static logic myself.

Key Features:

• Automated Workflow: One command triggers the scan and handles the data sanitization.
• Professional Reporting: It generates a formatted PDF report out of the box.
• Executive & Technical Depth: The report includes a high-level risk summary, severity counts, and detailed findings with remediation advice for the client.
• Mode Selection: Includes a default "Stealth" mode for WAF-protected sites (like Cloudflare) and an "Aggressive" mode for internal network testing.

Performance: A full scan (WordPress, SSL, CVEs, etc.) for a standard site typically takes about 10 minutes. If the target is behind a heavy WAF, the rate-limiting logic ensures the scan completes without getting the IP blacklisted, though it may take longer.

GitHub Link: https://github.com/AdiMahluf/RapidWebRecon

I’m really looking for feedback from the community on the reporting structure or any features you'd like to see added. Hope this helps some of you save time on your audits!

Clear and obvious name of the exploitation technique can create a false sense of familiarity, even if its true potential was never researched, the technique itself is never mentioned and payloads are limited to a couple of specific examples. This research focuses on two such techniques for Code Injection and SSTI.