https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T10:15:20.241411+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-24727 CVE-2022-24727 2026-10-20T10:15:20.243832+00:00 CVE-2022-24727 https://cve.radiocsirt.org/vuln/ghsa-3872-f48p-pxqj GHSA-3872-f48p-pxqj — Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate 2026-10-20T10:15:20.243879+00:00

Affected: PyPI: Weblate

### Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

### Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

* 35d59f1f040541c358cece0a8d4a63183ca919b8 * d83672a3e7415da1490334e2c9431e5da1966842

### Workarounds

Instances in which untrusted users cannot create new components are not affected.

### References * [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)

### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)