Sqlalchemy vulnerabilities
7 vulnerabilities
Known vulnerabilities in Sqlalchemy products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Mako4 vulnerabilities
- Sqlalchemy3 vulnerabilities
CVE-2022-40023alpinepy3-mako+20
EPSS score2.17%
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.CVE-2012-0805debiansqlalchemy+3EPSS score2.85%
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.CVE-2019-7548debiansqlalchemy+11EPSS score1.78%
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.CVE-2019-7164debiansqlalchemy+12EPSS score3.52%
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.CVE-2026-41205chainguardairflow-2+25EPSS score0.53%
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.CVE-2026-102991chainguardairflow-2+64EPSS score0.36%
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpath to absorb the traversal segments before the leading dot-dot check, while posixpath resolution can escape the configured template directory. An application that passes attacker-controlled template names or include paths can disclose process-readable files on the same volume, and a targeted file containing Mako template syntax may also be parsed and executed as a template. Raw URL paths are generally normalized before reaching this form, but query strings, form or JSON bodies, route parameters, and dynamic include expressions can preserve it. This issue is fixed in version 1.4.2.CVE-2026-44307chainguardairflow-2+16EPSS score0.89%
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.