CRITICAL 9.1

PYSEC-2026-2309

상세

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / weblate

최초 영향 버전: 0 수정 버전: 5.16

수정 pip install --upgrade 'weblate>=5.16'

참고

https://github.com/WeblateOrg/weblate/pull/17722 [REPORT]
https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd [FIX]
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47 [FIX]