Vulnerabilities for Mako

First version without a known vulnerability: 1.3.12

Details

• GHSA-2h4p-vjrc-8xpq2026-05-06

  Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

  Fixed in: 1.3.12

• GHSA-v92g-xgxw-vvmm2026-04-16

  Mako: Path traversal via double-slash URI prefix in TemplateLookup

  Fixed in: 1.3.11

• GHSA-v973-fxgf-6xhp2022-09-16

  mako is vulnerable to Regular Expression Denial of Service

  Fixed in: 1.2.2, 925760291d6efec64fda6e9dd1fd9cfbd5be068c

• GHSA-7q8x-38mc-p84f2022-05-17

  Mako contains Cross-site Scripting vulnerability

  Fixed in: 0.3.4