{"action":"Upgrade mako to 1.2.2 or later.","affected":[{"fixed":"1.2.2","introduced":"0"}],"component":"mako","cve_ids":["CVE-2022-40023"],"ecosystem":"PyPI","epss":0.0232,"exploited":false,"fixed_versions":["1.2.2"],"ghsa_id":"GHSA-v973-fxgf-6xhp","id":"tcs_01M5KGGV9FGB6JJYYH5X5CWJVR","modified_at":"2023-11-08T04:10:22.118239Z","published_at":"2022-09-07T13:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-260","https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c","https://pyup.io/vulnerabilities/CVE-2022-40023/50870/","https://github.com/sqlalchemy/mako/issues/366","https://github.com/sqlalchemy/mako/blob/c2f392e0be52dc67d1b9770ab8cce6a9c736d547/mako/ext/extract.py#L21","https://github.com/advisories/GHSA-v973-fxgf-6xhp"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-260","url":"https://osv.dev/vulnerability/PYSEC-2022-260"}],"summary":"Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin."}