GHSA-vmfc-9982-2m45 — medium GitHub Advisory (CVE-2026-50127) in pip/weblate

描述

Impact

Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

Patches

https://github.com/WeblateOrg/weblate/pull/19768

Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

基本資訊

類型: reviewed
嚴重度: medium
GitHub 上的公告: 開啟公告 ↗
儲存庫公告: 開啟儲存庫公告 ↗
原始碼: 瀏覽原始碼 ↗
公開（公告）: 2026-07-07 23:46:33 UTC
更新時間: 2026-07-07 23:46:35 UTC
GitHub 審核: 2026-07-07 23:46:33 UTC
NVD 公開: 2026-06-10

Score	Percentile
0.29%	20.60%

CVSS Scores

Base score	Version	Severity	Vector
5.9	3.1	—	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N` 點擊展開攻擊向量 (AV:N) 可經網際網路或企業內可路由網段從遠端觸達，攻擊者不必在裝置旁邊。攻擊複雜度 (AC:H) 即使網路可達，也常要卡時間窗、負載或特定版本組合才打得響。權限需求 (PR:N) 不必事先登入或提權，匿名工作階段也可能成為跳板。使用者互動 (UI:N) 不必受害者點連結、放行巨集或安裝軟體，攻擊鏈可自動走完。作用域 (S:U) 破壞局限在脆弱元件原本的安全權限與信任域之內。機密性影響 (C:H) 大量讀取、匯出或長期潛伏竊取機敏資料，在實務上成立。完整性影響 (I:N) 對紀錄真實性與不可否認性的破壞可忽略。可用性影響 (A:N) 不至於造成業務意義上的長時間停擺或災難性效能崩塌。

Identifiers

Type	Value
GHSA	GHSA-vmfc-9982-2m45 ↗
CVE	CVE-2026-50127 ↗

CWEs

CWE id	Name
CWE-918	Server-Side Request Forgery (SSRF)

Credits

tonghuaroot (reporter)
nijel (remediation_developer)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
pip	weblate	>= 5.15, < 2026.6	2026.6	—

Weblate SSRF: outbound URL guard misses some private ranges

描述