Keep input out of the template
The flaw is a template assembled from user input. The fix is to treat user data as data, never as part of the template source.
Tip: Render a fixed, pre-written template and pass user input as a context variable (
render_template('hi.html', name=name)), neverrender_template_string('Hi ' + name). If users must supply templates, use a sandboxed environment with a strict allow-list — and remember autoescaping stops XSS in the output, not the injection itself.