https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:48:08 +0000 https://cve.radiocsirt.org/vuln/cve-2026-41654 <p><strong>Affected:</strong> WeblateOrg weblate</p> <p>Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/&lt;name&gt;.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django&#39;s full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.</p> <p><strong>Affected:</strong> WeblateOrg weblate</p> <p>Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/&lt;name&gt;.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django&#39;s full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-41654 https://cve.radiocsirt.org/vuln/ghsa-cwcx-382v-8m9g <p><strong>Affected:</strong> PyPI: weblate</p> <p>### Impact An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose `components/&lt;name&gt;.json` contains an attacker-chosen `repo` URL pointing at a **private address** (e.g. `http://127.0.0.1:9999/`) or using a **non-allow-listed scheme** (e.g. `file://`, `git://`). Weblate persists the component via `Component.objects.bulk_create([component])[0]`, which bypasses Django&#39;s `full_clean()` and therefore never runs the `validate_repo_url` validator. The URL is subsequently written verbatim into `.git/config` by `configure_repo(pull=False)`.</p> <p>### Patches * https://github.com/WeblateOrg/weblate/pull/19061 * https://github.com/WeblateOrg/weblate/pull/19062</p> <p>### Workarounds Limiting who can create projects limits the scope.</p> <p>### Resources Weblate thanks @fg0x0 for reporting this vulnerability via GitHub.</p> <p><strong>Affected:</strong> PyPI: weblate</p> <p>### Impact An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose `components/&lt;name&gt;.json` contains an attacker-chosen `repo` URL pointing at a **private address** (e.g. `http://127.0.0.1:9999/`) or using a **non-allow-listed scheme** (e.g. `file://`, `git://`). Weblate persists the component via `Component.objects.bulk_create([component])[0]`, which bypasses Django&#39;s `full_clean()` and therefore never runs the `validate_repo_url` validator. The URL is subsequently written verbatim into `.git/config` by `configure_repo(pull=False)`.</p> <p>### Patches * https://github.com/WeblateOrg/weblate/pull/19061 * https://github.com/WeblateOrg/weblate/pull/19062</p> <p>### Workarounds Limiting who can create projects limits the scope.</p> <p>### Resources Weblate thanks @fg0x0 for reporting this vulnerability via GitHub.</p> https://cve.radiocsirt.org/vuln/ghsa-cwcx-382v-8m9g