Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
| Software | From | Fixed in |
|---|---|---|
| pocoo / babel | - | 2.9.1 |
| debian / debian_linux | 10.0 | 10.0.x |
babel
|
- | 2.9.1 |