A security patch for openedx/edx-platform will be added to the Ulmo and Verawood releases and to the current github master branch around 2026-07-22T14:00:00Z.
It will fix one security defect with a “moderate” CVSS 3.1 severity rating.
Details will be published here after release: GitHub security advisory
FYI, there are some delays merging this due to issues on the github tooling side. Working to resolve those issues.
Hi @feanil,
Thanks for the heads-up and for keeping everyone updated. Is there a new target date for the merge?
Appreciate your work on this!
The GitHub security-fork merge path remains broken so I have fast-forwarded the reviewed fix straight onto the target branches:
Same change on all three. The advisory is now published.