I don’t use Django but used to write many scripts in Salt. The double curly braces are used by various templating engines to inject variables into static files.

I don’t use Django but used to write many scripts in Salt. The double curly braces are used by various templating engines to inject variables into static files. The attack here is that an attacker can probably run unsafe code on the server and exfiltrate data or worse. I think by default Django will throw a 404 or 400 like you mentioned. OP would have liked the request to get zapped by the WAF though.