Python

A User repr formatted attacker-controlled data twice, so a Python format string injected into the username walked the object graph to RCE.