← Back

Mako

mako

Vendor: Sqlalchemy • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-41205
1Sqlalchemy
1Mako
May 20, 2026
Apr 23, 2026
7.7 HIGH· v4
7.5 HIGH· v3
N/A· v2
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency bet...Show more
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.Show less
CVE-2022-40023
2Debian
Sqlalchemy
2Debian Linux
Mako
Dec 3, 2025
Sep 7, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.