Spot template injection in Python web code
render_template_string or f-string templates built from user input give Jinja SSTI and full RCE.
Tag: python
Catch Python’s unsafe loaders and shell calls
pickle.loads, yaml.load, and subprocess with shell True are the three highest-yield greps in a Python review.