Mike Bayer

2 exploits Active since Sep 2022

CVE-2026-44307 WRITEUP HIGH WRITEUP

Mako: Path traversal via backslash URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.

View Code

CVE-2022-40023 WRITEUP HIGH WRITEUP

Sqlalchemy Mako < 1.2.2 - Denial of Service

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

CVSS 7.5

View Code