CVE-2010-2480
Mako contains Cross-site Scripting vulnerability
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
Exploit likelihood
What each source reports
NVD Score used
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
CVE-2010-2480- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
CVE-2010-2480- Updated
- 2026-11-02
EUVDEUVD-2010-0002 No score
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
EUVD-2010-0002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7q8x-38mc-p84f
Mako contains Cross-site Scripting vulnerability
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
GHSA-7q8x-38mc-p84f- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-7q8x-38mc-p84f
Mako contains Cross-site Scripting vulnerability
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
GHSA-7q8x-38mc-p84f- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
CVE-2010-2480- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2480 No score
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
DEBIAN-CVE-2010-2480- Updated
- 2026-11-02
OSVPYSEC-2010-1 No score
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
- Record
PYSEC-2010-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
makoPyPI |
before 0.3.4 | 0.3.4 |
makoDebian:12 |
before 0.3.4-1 | 0.3.4-1 |
makoDebian:13 |
before 0.3.4-1 | 0.3.4-1 |
makoDebian:14 |
before 0.3.4-1 | 0.3.4-1 |
makoPyPI |
before 0.3.4, plus listed versions 0.1.00.1.10.1.100.1.20.1.3 Show 16 moreShow less0.1.40.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.20.2.30.2.40.2.50.3.00.3.10.3.20.3.3 |
0.3.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2480 is a medium vulnerability (CVSS 4.3) in Makotemplates Mako, published July 2, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in mako 0.3.4.