{"action":"Upgrade weblate to 5.17.1 or later.","affected":[{"fixed":"5.17.1","introduced":"0"}],"component":"weblate","cve_ids":["CVE-2026-41654"],"ecosystem":"PyPI","epss":0.00371,"exploited":false,"fixed_versions":["5.17.1"],"ghsa_id":"GHSA-cwcx-382v-8m9g","id":"tcs_01M5KGYQXS4GCCVZGGYWR1TKT6","modified_at":"2026-07-13T07:15:48.299381512Z","published_at":"2026-05-07T15:16:07.907Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2317","https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1","https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0","https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14","https://github.com/WeblateOrg/weblate/pull/19061","https://github.com/WeblateOrg/weblate/pull/19062","https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-2317","url":"https://osv.dev/vulnerability/PYSEC-2026-2317"}],"summary":"Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial pl"}