Read the docs
TI-2010-02382 Aliases CVE-2010-2480GHSA-7q8x-38mc-p84f

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for…

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.

Why it matters now

EPSS 0.01818 78th percentileScored 2026-11-07
Fix Fixed mako (PyPI): 0.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—mako (PyPI)before 0.3.40.3.4Patch availableGHSA-7q8x-38mc-p84f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • mako (PyPI) Vendor— Affected before 0.3.4 Fixed in 0.3.4 Patch available GHSA-7q8x-38mc-p84f

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:makotemplates:mako:*:*:*:*:*:*:*:*up to 0.3.3VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.0:-:*:*:*:*:*:*0.1.0VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.1:*:*:*:*:*:*:*0.1.1VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.2:*:*:*:*:*:*:*0.1.2VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.3:*:*:*:*:*:*:*0.1.3VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.4:*:*:*:*:*:*:*0.1.4VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.5:*:*:*:*:*:*:*0.1.5VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.6:*:*:*:*:*:*:*0.1.6VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.7:*:*:*:*:*:*:*0.1.7VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.8:*:*:*:*:*:*:*0.1.8VulnerableMakotemplates
  • cpe:2.3:a:makotemplates:mako:*:*:*:*:*:*:*:* Versions up to 0.3.3 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.0:-:*:*:*:*:*:* Versions 0.1.0 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.1:*:*:*:*:*:*:* Versions 0.1.1 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.2:*:*:*:*:*:*:* Versions 0.1.2 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.3:*:*:*:*:*:*:* Versions 0.1.3 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.4:*:*:*:*:*:*:* Versions 0.1.4 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.5:*:*:*:*:*:*:* Versions 0.1.5 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.6:*:*:*:*:*:*:* Versions 0.1.6 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.7:*:*:*:*:*:*:* Versions 0.1.7 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.8:*:*:*:*:*:*:* Versions 0.1.8 Vulnerable ·Makotemplates
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:makotemplates:mako:0.1.9:*:*:*:*:*:*:*0.1.9VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.1.10:*:*:*:*:*:*:*0.1.10VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.0:*:*:*:*:*:*:*0.2.0VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.1:*:*:*:*:*:*:*0.2.1VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.2:*:*:*:*:*:*:*0.2.2VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.3:*:*:*:*:*:*:*0.2.3VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.4:*:*:*:*:*:*:*0.2.4VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.5:*:*:*:*:*:*:*0.2.5VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.2.6:*:*:*:*:*:*:*0.2.6VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.3:*:*:*:*:*:*:*0.3VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.3.1:*:*:*:*:*:*:*0.3.1VulnerableMakotemplates
cpe:2.3:a:makotemplates:mako:0.3.2:*:*:*:*:*:*:*0.3.2VulnerableMakotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.9:*:*:*:*:*:*:* Versions 0.1.9 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.1.10:*:*:*:*:*:*:* Versions 0.1.10 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.0:*:*:*:*:*:*:* Versions 0.2.0 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.3:*:*:*:*:*:*:* Versions 0.2.3 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.4:*:*:*:*:*:*:* Versions 0.2.4 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.5:*:*:*:*:*:*:* Versions 0.2.5 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.2.6:*:*:*:*:*:*:* Versions 0.2.6 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·Makotemplates
  • cpe:2.3:a:makotemplates:mako:0.3.2:*:*:*:*:*:*:* Versions 0.3.2 Vulnerable ·Makotemplates

Remediation

  • Fix · GHSA-7q8x-38mc-p84f mako (PyPI) Fixed in 0.3.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2480
  2. 2026-10-03 Alias added: GHSA-7q8x-38mc-p84f

References

Advisory 2

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences