Most recent entries from all

cnvd-2022-23501

EUVD-2026-177484

fkie_cve-2022-23915

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

GHSA-3872-f48p-pxqj — Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Affected: PyPI: Weblate

### Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

### Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

* 35d59f1f040541c358cece0a8d4a63183ca919b8 * d83672a3e7415da1490334e2c9431e5da1966842

### Workarounds

Instances in which untrusted users cannot create new components are not affected.

### References * [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)

### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

gsd-2022-23915

PYSEC-2022-31

Affected: PyPI: weblate