GitHub's CodeQL found critical RCE in German Covid app server

blog post (german): https://www.coronawarn.app/de/blog/2020-11-19-security-updat...

the template engine allowed remote code injected throug a country name into the error message