Re: [OE-core] [scarthgap][PATCH] python3-mako: Fix CVE-2026-41205

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Aug 31, 2026 at 11:22 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> On Mon, Aug 31, 2026 at 02:42 PM, Yoann Congal wrote:
>
>> 
>> On Wed Aug 19, 2026 at 1:15 PM CEST, Hetvi Thakar -X (hthakar - E
>> INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
>> 
>>> From: Hetvi Thakar <hthakar@cisco.com>
>>> 
>>> This patch applies the upstream fix as referenced in [2], using
>>> the commit shown in [1].
>>> 
>>> The backport makes Template URI normalization strip all leading
>>> slashes, preventing a double-slash URI from bypassing the path
>>> traversal check while keeping Mako at version 1.3.2.
>>> 
>>> [1] https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3
>>> 
>>> [2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm
>>> 
>>> Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
>>> ---
>>> .../python/python3-mako/CVE-2026-41205.patch | 110 ++++++++++++++++++
>>> .../python/python3-mako_1.3.2.bb | 2 +
>>> 2 files changed, 112 insertions(+)
>>> create mode 100644
>>> meta/recipes-devtools/python/python3-mako/CVE-2026-41205.patch
>> 
>> Hello,
>> 
>> As fas as I can tell, a fix for this CVE is also needed on wrynose.
>> 
>> I can't merge here until this is fixed there.
>> 
>> Can you send a patch to fix this and then, ping back here?
>> 
>> Thanks!
>> --
>> Yoann Congal
>> Smile ECS
>
> Hi,
>
> I have submitted a package upgrade for wrynose that addresses this
> CVE:
>
> https://lists.openembedded.org/g/openembedded-core/message/244285 ( https://lists.openembedded.org/g/openembedded-core/message/244285 )
>
> Could you please take a look and review it?
>
> Regards,
> Hetvi

Thanks for the quick answer.

I will review both but not in the current cycle.

Regards,
-- 
Yoann Congal
Smile ECS