tocsin

PyPI/mako CVE-2026-41205: high 7.5, EPSS 0.36%

Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is

Action: Upgrade mako to 1.3.11 or later.

pip install mako==1.3.11

Affected

introducedfixedlast affected
01.3.11-

Fixed versions

1.3.11

Sources

CVE-2026-41205 · published · modified · JSON