This vulnerability stems from using Jinja's |safe filter to embed JSON data directly into an inline <script> block within a capture tree visualization template. The developer likely made a conscious choice—auto-escaped output was breaking their JavaScript context, and |safe was the immediate, ergonomic solution. The filter is documented, intentional, and right there in the framework. It works. That's the problem: the insecure pattern is the path of least resistance.
The fix (moving to a dedicated API endpoint) is architecturally superior, but it requires genuine additional work—new route handler, error handling, client-side async logic. Meanwhile, |safe is one line. This is a structural incentive problem, not developer laziness. The secure pattern should be the frictionless pattern, and until frameworks provide first-class support for the dedicated-API pattern at the same ergonomic cost as inline embedding, the same mutation will recur in future features.
What makes this instance catastrophically worse than the CVSS suggests: the victim is an analyst viewing a capture tree—someone who has been collecting network traffic that may include credentials, API keys, PII, or session tokens from other users. Compromising this user doesn't give a low-privilege foothold; it gives access to everything they've captured. This is a high-value target with blast radius that the generic CVSS calculation underweights.
After patching, don't just verify the dedicated endpoint works—audit every |safe call in the same template family. Whoever reached for |safe here was likely operating under a mental model ('the escaping is blocking me, I'll opt out') that exists in other templates waiting for the next friction point to reactivate. This specific mutation—inline JSON via |safe in data-aggregation visualization—has ancestors (similar patterns appeared in prior Flask/Django CVEs). The knowledge exists; the failure is synthesis—connecting the pattern at commit time before it ships.