Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/mako@1.2.2
purl pkg:pypi/mako@1.2.2
Next non-vulnerable version 1.3.11
Latest non-vulnerable version 1.3.11
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-78vq-wbe5-aygj
Aliases:
CVE-2026-41205
GHSA-v92g-xgxw-vvmm
PYSEC-2026-88
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.
1.3.11
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-7157-v8k4-gbbx Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023
GHSA-v973-fxgf-6xhp
PYSEC-2022-260

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:24:53.741838+00:00 Pypa Importer Affected by VCID-78vq-wbe5-aygj https://github.com/pypa/advisory-database/blob/main/vulns/mako/PYSEC-2026-88.yaml 38.6.0
2026-06-02T04:17:39.774925+00:00 Pypa Importer Fixing VCID-7157-v8k4-gbbx https://github.com/pypa/advisory-database/blob/main/vulns/mako/PYSEC-2022-260.yaml 38.6.0