Executing user-provided code isn't possible. f-strings must be literals, so there's no user-defined strings involved. You could of course eval something the us

Executing user-provided code isn't possible. f-strings must be literals, so there's no user-defined strings involved. You could of course eval something the user provided, but there's no more of a risk with f-strings than there is with regular code. This is addressed in PEP 498.