Mako
Monthly
Arbitrary file read in Mako (the Python template library maintained under the SQLAlchemy project) affects all versions prior to 1.3.11, where TemplateLookup.get_template() mishandles URIs beginning with a double slash (e.g. //../../../etc/passwd). Because get_template() strips all leading slashes while Template.__init__ stripped only one, the 'relative outside of root' safety check is bypassed, letting any file readable by the process be returned as rendered template content when an application feeds untrusted input into get_template(). CVSS 4.0 rates it 7.7 (confidentiality-only); it is not in CISA KEV and EPSS is very low (0.05%), but the CVSS exploit-maturity flag E:P and the vendor's published test cases indicate proof-of-concept exploit code exists.
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary file read in Mako (the Python template library maintained under the SQLAlchemy project) affects all versions prior to 1.3.11, where TemplateLookup.get_template() mishandles URIs beginning with a double slash (e.g. //../../../etc/passwd). Because get_template() strips all leading slashes while Template.__init__ stripped only one, the 'relative outside of root' safety check is bypassed, letting any file readable by the process be returned as rendered template content when an application feeds untrusted input into get_template(). CVSS 4.0 rates it 7.7 (confidentiality-only); it is not in CISA KEV and EPSS is very low (0.05%), but the CVSS exploit-maturity flag E:P and the vendor's published test cases indicate proof-of-concept exploit code exists.
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.