Sqlalchemy

7 CVEs in 2 Sqlalchemy products, including Mako, Sqlalchemy. Newest: CVE-2026-102991 (2026-09-30). Severity, EPSS and public exploits for each.

Sqlalchemy products with known CVEs

ProductCVEs
Mako4
Sqlalchemy3
Sqlalchemy CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-102991Medium6.52026-09-30Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath…
CVE-2026-443072026-05-12Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory tra…
CVE-2026-41205High7.52026-04-23Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., /…
CVE-2022-40023High7.52022-09-07Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and lingu…
CVE-2019-7164Critical9.82019-02-20SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
CVE-2019-7548High7.82019-02-06SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
CVE-2012-08052012-06-05Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1)…