On Wed Aug 19, 2026 at 1:15 PM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:

From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].

The backport makes Template URI normalization strip all leading
slashes, preventing a double-slash URI from bypassing the path
traversal check while keeping Mako at version 1.3.2.

[1] https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
[2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
.../python/python3-mako/CVE-2026-41205.patch | 110 ++++++++++++++++++
.../python/python3-mako_1.3.2.bb | 2 +
2 files changed, 112 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-mako/CVE-2026-41205.patch
Hello,

As fas as I can tell, a fix for this CVE is also needed on wrynose.

I can't merge here until this is fixed there.

Can you send a patch to fix this and then, ping back here?

Thanks!
--
Yoann Congal
Smile ECS

Hi,

I have submitted a package upgrade for wrynose that addresses this
CVE:

https://lists.openembedded.org/g/openembedded-core/message/244285

Could you please take a look and review it?

Regards,
Hetvi