This is a pretty good example of why I hate big frameworks. They are simply too big to prevent stupid issues like YAML extraction in JSON and XML. If you are like me, you would expect that YAML was used in the configuration files and nowhere else. A small framework like Sinatra wouldn't have been big enough to hide an issue like this.
Really? Has a giant framework like Django had bugs this severe, that allowed data-file parsers to execute arbitrary attacker code?
The OP specifically mentioned that a similar bug was found in Django, and had previously been found in another big java framework.
I understand the appeal of "magic" to solve issues when you are under a deadline. It is just that trusting it is dangerous.