CVE-2010-2480: Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting...

Security readout for executives and security teams

This is an old cross-site scripting weakness in Mako templates before 0.3.4. If a web application used vulnerable Mako escaping for untrusted input, an attacker could potentially make a user’s browser run attacker-controlled script. The source bundle does not provide CVSS, broad affected-product mapping, or evidence of active exploitation. Exposure is most likely in legacy Python web applications using Mako versions earlier than 0.3.4, especially where templates render attacker-controlled content. Modern environments are unlikely to be affected unless they preserve very old dependencies. Treat this as a legacy dependency hygiene issue unless inventory finds exposed old Mako deployments. If present in an internet-facing application, prioritize remediation because XSS can affect user trust, sessions, and application integrity. Mitigation focus: Inventory Python applications for Mako versions earlier than 0.3.4.; Upgrade Mako to 0.3.4 or later where applicable.; Review vendor change notes before deploying fixes to legacy systems..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.