cube-js/cube · error · minijinja::Error

insecure call

Error message

insecure call

What it means

A security sentinel guard: a Python/Jinja sequence object exposed to templates was used in call position (e.g. {{ mylist(...) }}). Sequence objects are only indexable/iterable from Jinja; making them callable could execute arbitrary underlying code, so invocation is rejected with this fixed message.

Source

Thrown at packages/cubejs-backend-native/src/template/mj_value/value.rs:40

}

impl SeqObject for JinjaSequenceObject {
    fn get_item(&self, idx: usize) -> Option<Value> {
        self.inner.get(idx).map(|v| to_minijinja_value(v.clone()))
    }

    fn item_count(&self) -> usize {
        self.inner.len()
    }
}

impl Object for JinjaSequenceObject {
    fn kind(&self) -> ObjectKind<'_> {
        ObjectKind::Seq(self)
    }

    fn call(&self, _state: &mj::State, _args: &[Value]) -> Result<Value, mj::Error> {
        Err(mj::Error::new(
            minijinja::ErrorKind::InvalidOperation,
            "insecure call",
        ))
    }

    fn call_method(
        &self,
        _state: &mj::State,
        _name: &str,
        _args: &[Value],
    ) -> Result<Value, mj::Error> {
        Err(mj::Error::new(
            minijinja::ErrorKind::InvalidOperation,
            "insecure method call",
        ))
    }
}

View on GitHub (pinned to 7d981676b3)

Solutions

1. Index or iterate the sequence instead of calling it, e.g. {{ mylist[0] }} or {% for x in mylist %}
2. Expose a proper function object if calling is genuinely needed

When it happens

Trigger: Thrown at packages/cubejs-backend-native/src/template/mj_value/value.rs:40 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/102d7b6612a1ef28. Report an issue: GitHub.