It does if you use "sandbox" mode, but that's not the default: https://jinja.palletsprojects.com/en/stable/sandbox/

ehh, it's Python, it's mostly vibe-based.

https://stackoverflow.com/a/32802486

though there's sandbox: https://jinja.palletsprojects.com/en/stable/sandbox/

it simply predates the "sanitize by default" mindset/convention that nowadays React (dangerouslySetInnerHTML) and Angular has.