GHSA-3872-f48p-pxqj — Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Affected: PyPI: Weblate

### Impact Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

### Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

* 35d59f1f040541c358cece0a8d4a63183ca919b8 * d83672a3e7415da1490334e2c9431e5da1966842

### Workarounds

Instances in which untrusted users cannot create new components are not affected.

### References * [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)

### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

Most recent entries from all

CVE-2022-24727

GHSA-3872-f48p-pxqj — Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate