Are Django-templates safe for third parties to access?

Question

Django

I want to sketch something like a website builder. You need to give users the opportunity to upload their site templates and edit them directly on the server. Personally, I... I can't think of a way to break a site or get unauthorized access to other people's data only with the help of templates and tags, but... I can't find it, was there such information anywhere? Or is it better to write your own templates? (Which is debatable, for sure they will also be full of holes from the first ten times)

Answer 1

Python code cannot be injected, but XSS can. And steal cookies through it, make redirects, etc.