Description
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sqlalchemy | mako | < 1.3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mako | No fix yet | — |
| Debian 13 | mako | No fix yet | — |
| Debian 12 | mako | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | mako | 1.3.10-3ubuntu0.1 | — |
| Ubuntu 25.10 | mako | 1.3.9-1ubuntu0.1 | — |
| Ubuntu 24.04 LTS | mako | 1.3.2-1ubuntu0.1 | — |
| Ubuntu 22.04 LTS | mako | 1.1.3+ds1-2ubuntu0.2 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | mako | 1.1.0+ds1-1ubuntu2.1+esm1 | — |
| Ubuntu Pro 18.04 LTS | mako | 1.0.7+ds1-1ubuntu0.2+esm1 | — |
| Ubuntu Pro 16.04 LTS | mako | 1.0.3+ds1-1ubuntu1+esm2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Mako | 1.3.11-1.1 | openSUSE-SU-2026:10616-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-mako +1 | 1.1.4-3.amzn2023.0.4 | ALAS2023-2026-1846 |
| Amazon Linux 2 | python-mako | 0.8.1-2.amzn2.0.2 | ALAS2-2026-3333 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-mako | 1.2.4-3 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.1-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.5.5-r4 | — |
| Wolfi rolling | open-webui | 0.8.12-r4 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r9 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mako | < 1.3.11 | 1.3.11 | GHSA-v92g-xgxw-vvmm |
Advisories 3
- ALAS2023-2026-1846 Moderate: python-mako security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- ALAS2-2026-3333 Moderate: python-mako security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- openSUSE-SU-2026:10616-1 python311-Mako-1.3.11-1.1 on GA media SUSE / openSUSE Security Updates · Apr 26, 2026