PyPI/weblate CVE-2026-33220: medium 6.8, EPSS 0.39%

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

Action: Upgrade weblate to 5.17 or later.

pip install weblate==5.17

Affected

Fixed versions

Sources

• osv: GHSA-mqph-7h49-hqfm
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mqph-7h49-hqfm
• https://nvd.nist.gov/vuln/detail/CVE-2026-33220
• https://github.com/WeblateOrg/weblate/pull/18516
• https://github.com/WeblateOrg/weblate
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-153.yaml

CVE-2026-33220 · published 2026-04-16T20:41:29Z · modified 2026-06-08T20:00:10.696329386Z · JSON