CVE-2026-78391: Jinja Inline Event Handler Xsscve-2026-78391-jinja-inline-event-handler-xss
Jinja template variable rendered inside an inline JavaScript event handler attribute. HTML entity autoescaping (e.g. ') does not prevent XSS in JavaScript execution contexts because the browser decodes HTML entities before executing inline script handlers. Use data-* attributes combined with separate JavaScript event listeners instead.