Sqlalchemy vulnerabilities
We track 3 vulnerabilities in Sqlalchemy products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 12, 2026.
Latest Sqlalchemy vulnerabilities
- 8.7 High severity
mako: Improper Limitation of a Pathname to a Restricted Directory
Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_templat
- 7.5 High severity
mako: Improper Limitation of a Pathname to a Restricted Directory
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations
- 7.5 High severity
Mako: Inefficient Regular Expression Complexity
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.