In T273020#7271039, @sbassett wrote:

Security Review Summary - T273020 - 2021-08-09
Last commit reviewed: d9e475d1ff13

[...snip...]

For the application's node/js/vue code, I ran njsscan (default rule set) and semgrep (javascript, ci, security-audit rule, generic, contrib sets) static analysis tools. The following are the only results I found potentially worthy of review:

File	Line(s)	Issue	Risk
vue/templates/vue/base.html	20	Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using force_escape to explicitly escape a transalted text.	Medium
vue/templates/vue/main.html	9	Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using force_escape to explicitly escape a transalted text.	Medium

From https://docs.djangoproject.com/en/2.2/topics/i18n/translation/#internationalization-in-template-code:

WARNING: Translated strings will not be escaped when rendered in a template. This allows you to include HTML in translations, for example for emphasis, but potentially dangerous characters (e.g. ") will also be rendered unchanged.