CVE-2010-2480: Makotemplates Mako

Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days.

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.

Affected products

• Makotemplates Mako: up to and including 0.3.3; version 0.1.0 only; version 0.1.1 only; version 0.1.2 only; version 0.1.3 only; version 0.1.4 only; …

Published 2010-07-02. Last modified 2026-06-16.