CVE-2010-2480
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- EPSS
- 1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- makotemplates:mako
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7q8x-38mc-p84f | PyPI | mako | <0.3.4 | 0.3.4 |
| PYSEC-2010-1 | PyPI | mako | <0.3.4 | 0.3.4 |