Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2026-39845

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-f8hv-g549-hwg2

Weblate: SSRF via the webhook add-on using unprotected fetch_url() ### Impact The webhook add-on did not utilize existing SSRF protection. ### Patches * https://github.com/WeblateOrg/weblate/pull/18815 ### Workarounds Disabling the add-on would avoid misusing this. ### References Thanks to @Lihfdgjr for reporting this via GitHub.

gitlab/pypi/Weblate/CVE-2026-39845

Weblate: SSRF via the webhook add-on using unprotected fetch_url() The webhook add-on did not utilize existing SSRF protection.

pypa/weblate/PYSEC-2026-156

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

pysec/PYSEC-2026-156

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.