Jinja2, a template engine written in pure python, was found to use /tmp as a default directory for jinja2.bccache.FileSystemBytecodeCache, which is insecure because the /tmp directory is world-writable and the filenames used by FileSystemBytecodeCache are predictable. A malicious local user could exploit this bug to alter output generated by other user's application using Jinja2 or possibly, execute arbitrary code as another user.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.