diff --git a/mail/mailman/Makefile b/mail/mailman/Makefile
index 4f08ecf7ed0..b2ede5f409b 100644
--- a/mail/mailman/Makefile
+++ b/mail/mailman/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.17 2003/01/18 18:25:10 sturm Exp $
+# $OpenBSD: Makefile,v 1.18 2003/01/27 10:47:04 sturm Exp $
 
 COMMENT=	"mailing list manager with web interface"
 
@@ -18,6 +18,11 @@ PERMIT_DISTFILES_FTP=	Yes
 MASTER_SITES=		${MASTER_SITE_SOURCEFORGE:=mailman/}
 EXTRACT_SUFX=		.tgz
 
+# workaround XSS bug, will be part of 2.1.1
+PATCH_DIST_ARGS=	-b ${DISTORIG} -d ${WRKSRC}/Mailman/Cgi --forward \
+				--quiet -E ${PATCH_DIST_STRIP}
+PATCHFILES=		xss-2.1.0-patch.txt
+
 PYTHON_VER=		2.2
 BUILD_DEPENDS=		${RUN_DEPENDS}
 RUN_DEPENDS=		:python-${PYTHON_VER}*:lang/python/${PYTHON_VER}
diff --git a/mail/mailman/distinfo b/mail/mailman/distinfo
index 42da0526b09..742f19b0b27 100644
--- a/mail/mailman/distinfo
+++ b/mail/mailman/distinfo
@@ -1,3 +1,6 @@
 MD5 (mailman-2.1.tgz) = d486abaa1404e2fe93d72d3cdd9c84af
+MD5 (xss-2.1.0-patch.txt) = 4dad8d1bcc5a903ee37d81726d91b822
 RMD160 (mailman-2.1.tgz) = c11d92a462884e81912965685d51550abf37da7d
+RMD160 (xss-2.1.0-patch.txt) = f58f627cd8fd74a709d438b223fde65c8b690b6d
 SHA1 (mailman-2.1.tgz) = 40ec15fd891269be6014e3566379031b85b4ebf2
+SHA1 (xss-2.1.0-patch.txt) = ae7df8760f4b2c2d5cf964148720f88c3e63be97