Re: [OE-core][scarthgap][PATCH] python3-mako: Fix CVE-2026-41205

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Aug 19, 2026 at 1:15 PM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Hetvi Thakar <hthakar@cisco.com>
>
> This patch applies the upstream fix as referenced in [2], using
> the commit shown in [1].
>
> The backport makes Template URI normalization strip all leading
> slashes, preventing a double-slash URI from bypassing the path
> traversal check while keeping Mako at version 1.3.2.
>
> [1] https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
> [2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm
>
> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
> ---
>  .../python/python3-mako/CVE-2026-41205.patch  | 110 ++++++++++++++++++
>  .../python/python3-mako_1.3.2.bb              |   2 +
>  2 files changed, 112 insertions(+)
>  create mode 100644 meta/recipes-devtools/python/python3-mako/CVE-2026-41205.patch

Hello,

As fas as I can tell, a fix for this CVE is also needed on wrynose.

I can't merge here until this is fixed there.

Can you send a patch to fix this and then, ping back here?

Thanks!
-- 
Yoann Congal
Smile ECS