From 468b85bcae86a3d66a5c98a577a182b614b58821 Mon Sep 17 00:00:00 2001 From: Wiam Skakri Date: Mon, 6 Apr 2026 00:03:24 -0400 Subject: [PATCH] Fix Jinja2 autoescape disabled XSS vulnerability Enable autoescape=True in the Jinja2 Environment to prevent cross-site scripting via user-controlled template variables. Flagged by Bandit (B701) and Semgrep. --- backend/services/messaging/template_service.py | 1 + 1 file changed, 1 insertion(+) diff --git a/backend/services/messaging/template_service.py b/backend/services/messaging/template_service.py index 026e0ca05c..efdf353b03 100644 --- a/backend/services/messaging/template_service.py +++ b/backend/services/messaging/template_service.py @@ -9,6 +9,7 @@ # Set up Jinja2 environment env = Environment( loader=FileSystemLoader(os.path.join(os.path.dirname(__file__), "templates")), + autoescape=True, )