babel is vulnerable to directory traversal. The vulnerability allows an attacker to load arbitrary locale .dat
files which contain serialized Python objects. This can potentially lead to arbitrary code execution If an attacker is able to load a malicious local .dat
file through Babel.Locale()
.