translation-injection (E8151)

.format() is called on a translated string.

What it does

Reports _("...").format(...).

Why is this bad?

A translation can contain attribute or index lookups such as {0.__class__}, which str.format evaluates: a translator, or anyone who can edit translations, can read data through it. Use % placeholders and pass the values to _(). See Be careful with str.format.