by Kastro
Paper/Archive/CVE-2026-24126

CVE-2026-24126

WeblateOrg weblate — Weblate has an argument injection in management console

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 44.1.441 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Affected

ProductAffectedFixed inSource
weblate< 5.16.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)6.6CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47refgithub.com/WeblateOrg/weblate/pull/17722refgithub.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd