Description
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mako | 0.3.4-1 | — |
| Debian 13 | mako | 0.3.4-1 | — |
| Debian 12 | mako | 0.3.4-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mako | < 0.3.4 | 0.3.4 | GHSA-7q8x-38mc-p84f |
References
- http://www.makotemplates.org/CHANGES
- http://bugs.python.org/issue9061
- SUSE-SR:2010:014 vendor-advisory
- 39935 third-party-advisory