Detected a segment of a Flask template where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Ensure no user data is rendered here, otherwise this is a cross-site scripting (XSS) vulnerability, or turn autoescape on.
$('.f-{{ key }}').select2({ tags: {% if data %}{% autoescape false %}{{ data|json }}{% endautoescape %}{% else %}[]{% endif %} });