fix: 8.7 CVEs

Metadata

Project: snapcraft
Number: #5311
Type: pull request
State: merged
Author: mr-cal
Labels: —
Created: 2025-03-06 04:06 PM UTC
Updated: 2025-03-06 05:58 PM UTC
Closed: 2025-03-06 05:58 PM UTC

Current evaluation

Merged into 8.7.2, backporting #5290’s importlib-based core20 plugin loading and #5305’s Jinja 3.1.6 update to address CVE-2024-12797 and CVE-2025-27516.

Resolution: closed resolved

Reason: PR #5311 was approved and merged as the 8.7.2 security backport. It cherry-picked merged PRs #5290 (core20 plugin loading; commits df498f0dc and 5edefe1ab) and #5305 (Jinja 3.1.6), addressing the listed CVEs.

Evaluated by: mr-cal-bot

No scores available.

Issue body

- [x] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)? - [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? - [x] Have you successfully run `make lint`? - [x] Have you successfully run `make test`? --- Cherry-pick #5290 and #5305 to address [CVE-2024-12797](https://osv.dev/vulnerability/GHSA-79v4-65xg-pq4g) and [CVE-2025-27516](https://osv.dev/vulnerability/CVE-2025-27516) for an 8.7.2 release.

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-03 01:58 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Merged into 8.7.2, backporting #5290’s importlib-based core20 plugin loading and #5305’s Jinja 3.1.6 update to address CVE-2024-12797 and CVE-2025-27516.
2026-09-25 12:40 AM UTC	stealth/space-bunny-alpha	—	closed resolved	Merged into 8.7.2: backported #5290’s importlib-based core20 plugin loading and #5305’s Jinja 3.1.6 update to address CVE-2024-12797 and CVE-2025-27516.
2026-07-23 12:25 PM UTC	qwen/qwen3.6-35b-a3b	—	—	Merged to patch CVE-2024-12797 and CVE-2025-27516 for the 8.7.2 release. Changes were cherry-picked from PRs #5290 and #5305, received two approvals, and passed all CI checks.
2026-07-17 12:38 AM UTC	qwen3.6-35b-a3b-mtp-q6	—	—	Merged cherry-picks of #5290 and #5305 to resolve CVE-2024-12797 and CVE-2025-27516 for the snapcraft 8.7.2 release.

Update history

No update history recorded yet.

Related work

Likely Fixed By: snapcraft#5290 (confidence 100%)
Backported the importlib-based core20 local-plugin loading fix.
Likely Fixed By: snapcraft#5305 (confidence 100%)
Backported the Jinja 3.1.6 dependency update.

Related issues

No related issues found above the similarity threshold.