Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: weblate

Found 13 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-39845
4.1 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 10 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 14 hours ago
  • @LeSuisse ignored
    8 packages
    • python314Packages.weblate-language-data
    • python313Packages.weblate-language-data
    • python314Packages.weblate-schemas
    • python313Packages.weblate-schemas
    • python312Packages.weblate-schemas
    • python314Packages.weblate-fonts
    • python313Packages.weblate-fonts
    • python312Packages.weblate-language-data
    10 hours ago
  • @LeSuisse accepted 10 hours ago
  • @LeSuisse published on GitHub 10 hours ago
Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

Affected products

weblate
  • ==< 5.17

Matching in nixpkgs

pkgs.weblate

Web based translation tool with tight version control integration

Ignored packages (8)

Package maintainers

Published
Permalink CVE-2026-27457
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 1 month, 2 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion 1 month, 2 weeks ago
  • @LeSuisse ignored
    6 packages
    • python312Packages.weblate-schemas
    • python313Packages.weblate-schemas
    • python314Packages.weblate-schemas
    • python312Packages.weblate-language-data
    • python313Packages.weblate-language-data
    • python314Packages.weblate-language-data
    1 month, 2 weeks ago
  • @LeSuisse accepted 1 month, 2 weeks ago
  • @LeSuisse published on GitHub 1 month, 2 weeks ago
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.

Affected products

weblate
  • ==< 5.16.1

Matching in nixpkgs

pkgs.weblate

Web based translation tool with tight version control integration

Ignored packages (6)

Package maintainers

Upstream advisory: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-wppc-7cq7-cgfv
Upstream patches:
* https://github.com/WeblateOrg/weblate/commit/3f58f9a4152bc0cbdd6eff5954f9c7bc4d9f0af9
* https://github.com/WeblateOrg/weblate/commit/7802c9b121eb407c48d4adddd4f2458fb3efef0f
Published
Permalink CVE-2025-68398
9.1 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): HIGH
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 2 months, 1 week ago by @LeSuisse Activity log
  • Created automatic suggestion 2 months, 1 week ago
  • @LeSuisse ignored
    6 packages
    • python312Packages.weblate-schemas
    • python313Packages.weblate-schemas
    • python314Packages.weblate-schemas
    • python312Packages.weblate-language-data
    • python313Packages.weblate-language-data
    • python314Packages.weblate-language-data
    2 months, 1 week ago
  • @LeSuisse accepted 2 months, 1 week ago
  • @LeSuisse published on GitHub 2 months, 1 week ago
Weblate has git config file overwrite vulnerability that leads to remote code execution

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

Affected products

weblate
  • ==< 5.15.1

Matching in nixpkgs

pkgs.weblate

Web based translation tool with tight version control integration

Ignored packages (6)

Package maintainers

Upstream advisory: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
Upstream patch: https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7 and https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4