https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T21:46:31.580977+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-23501 cnvd-2022-23501 2026-10-20T21:46:31.584348+00:00 cnvd-2022-23501 https://cve.radiocsirt.org/vuln/euvd-2026-177484 EUVD-2026-177484 2026-10-20T21:46:31.584385+00:00 EUVD-2026-177484 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23915 fkie_cve-2022-23915 2026-10-20T21:46:31.584399+00:00

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

 https://cve.radiocsirt.org/vuln/ghsa-3872-f48p-pxqj GHSA-3872-f48p-pxqj — Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate 2026-10-20T21:46:31.584429+00:00

Affected: PyPI: Weblate

### Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

### Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

* 35d59f1f040541c358cece0a8d4a63183ca919b8 * d83672a3e7415da1490334e2c9431e5da1966842

### Workarounds

Instances in which untrusted users cannot create new components are not affected.

### References * [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)

### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

 https://cve.radiocsirt.org/vuln/gsd-2022-23915 gsd-2022-23915 2026-10-20T21:46:31.584462+00:00 gsd-2022-23915 https://cve.radiocsirt.org/vuln/pysec-2022-31 PYSEC-2022-31 2026-10-20T21:46:31.584475+00:00

Affected: PyPI: weblate

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.