Skip to content
OpenAdvisories

Package · PyPI

mako

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.5
    CVE-2026-102991

    Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

    Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A UR…

    sqlalchemy mako reflex mako Ubuntu Azure Linux Wolfi PyPI
  • High 8.7
    CVE-2026-44307

    Mako: Path traversal via backslash URI on Windows in TemplateLookup

    Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_templa…

    sqlalchemy mako airflow-3 reflex Wolfi PyPI
  • High 7.7
    CVE-2026-41205

    Mako: Path traversal via double-slash URI prefix in TemplateLookup

    Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementation…

    sqlalchemy mako open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2022-40023

    mako is vulnerable to Regular Expression Denial of Service

    Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

    mako mako mako python-mako Debian Ubuntu Azure Linux Alpine PyPI
  • Medium 6.1
    CVE-2010-2480

    Mako contains Cross-site Scripting vulnerability

    Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLo…

    mako mako Debian PyPI