Spot template injection in Python web code

Jun 21, 2026 · 1 min read

The dangerous pattern is a template compiled from data, not a fixed file. In Flask that is render_template_string; in Django it is Template(user_input).

bash

grep -rEn "render_template_string|Template(|from_string(|Environment(" --include=*.py .
grep -rEn "f['"].*{.*(request|user|input)" --include=*.py .

The vulnerable form embeds input in the template source.

python

render_template_string("Hello " + name)  # name={{7*7}} -> SSTI -> RCE

Pro note: passing user data as a context variable is safe; compiling it into the template is not. The same mistake appears in email templating and PDF generation libraries, which often use Jinja under the hood with autoescape off.