[AutoPR- Security] Patch conda for CVE-2026-53940 [HIGH]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch conda for CVE-2026-53940.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1208154&view=results

CVE-2026-53940 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1208163&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch conda for CVE-2026-53940 (HIGH).

Change Log

• CVE-2026-53940

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-53940

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[AkarshHCL]

1. We are vulnerable range for this CVE < 26.5.2.
2. Some changes were added to the patch to make it in sync with upstream patch and to fix the failing buddy build.
3. Changes in the patch-

The important one: the patch never added import keyword, but is_valid_import_path() uses
keyword.iskeyword(). Applying the original patch to a clean 24.3.0 tree:

>>> parse_entry_point_def("conda = conda.cli.main:main")
NameError: name 'keyword' is not defined

So every noarch:python install would have broken. Easy to miss, because if you only test the CVE
payload it still looks fine — the command character check rejects ../bin/pip before
is_valid_import_path is ever reached. Only legitimate entry points hit it.

Also missing: both of upstream's normpath() containment checks in path_actions.py (the
patch added a bare import os for them but not the guards themselves). Added both back. Upstream
uses a BIN_DIRECTORY constant that doesn't exist in 24.3.0, so I hoisted
get_bin_directory_short_path() into a local instead.

Wrong paths: the news file landed in tests/common/pkg_formats/news/ instead of news/, and
the tests went into tests/common/pkg_formats/test_python.py. That file covers
conda/common/pkg_formats/python.py — unrelated module, it just happens to share the name with
upstream's new test file. Since conda/common/path is still a flat module in 24.3.0 (it's a
package upstream), the right home is tests/common/test_path.py.

Rest was minor: merged the duplicate common.path import in gateways/disk/create.py, restored
the path: str -> bool annotations, added from __future__ import annotations to
test_path_actions.py to match upstream.

4. Local build has passed successfully-

5. Patch is getting applied cleanly- 6. Newly added tests are also getiing passed successfully .

7. Buddy Build after changes -
   https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1209396&view=results