CVE-2022-40023: PYSEC-2022-260 - Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects ba

CVE-2022-40023 · Severity: low · CVSS 3.1 · Published 2022-09-07

Technologies: Mako (PyPI). Vendors: PyPI.

Executive brief

Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.

Affected products

PyPI Mako

Related threats

SQLAlchemy Mako path traversal on Windows via backslash URIs
SQLAlchemy Mako path traversal in TemplateLookup
PYSEC-2010-1 - Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it