Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

mako

5 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 high, 1 medium
Weekly downloads
53M
Dependents
9,300
Registry
PyPI

Advisories 5

  • CVE-2026-102991Medium 6.5

    Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

    Affected: fixed in 1.4.2.

  • Mako: Path traversal via backslash URI on Windows in TemplateLookup

    Affected: fixed in 1.3.12.

  • Mako: Path traversal via double-slash URI prefix in TemplateLookup

    Affected: fixed in 1.3.11.

  • Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse.

    Affected: fixed in 1.2.2.

  • Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes…

    Affected: fixed in 0.3.4.