Every CVE Search/ Get API key

CVE-2022-23915

Remote Code Execution (RCE)

7.2 HighFix available

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.10%Down 1.3 points since Mar 5, 2022
90%50%10%1%

What each source reports

CVE List Score used 7.2

Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Record
CVE-2022-23915
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2022-0361 7.2

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Record
EUVD-2022-0361
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-3872-f48p-pxqj 8.7

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact

Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

  • 35d59f1f040541c358cece0a8d4a63183ca919b8
  • d83672a3e7415da1490334e2c9431e5da1966842

Workarounds

Instances in which untrusted users cannot create new components are not affected.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-3872-f48p-pxqj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-88
Updated
2026-11-02
NVD 7.2

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Record
CVE-2022-23915
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-88
Updated
2026-11-02
OSV 7.2

Remote Code Execution (RCE)

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Record
CVE-2022-23915
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-3872-f48p-pxqj 8.7

Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate

Impact

Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

  • 35d59f1f040541c358cece0a8d4a63183ca919b8
  • d83672a3e7415da1490334e2c9431e5da1966842

Workarounds

Instances in which untrusted users cannot create new components are not affected.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-3872-f48p-pxqj
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-88
Updated
2026-11-02
Show 4 moreShow less
OSVBIT-weblate-2022-23915 No score

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Record
BIT-weblate-2022-23915
Updated
2026-11-02
OSVGHSA-h2g5-2rhx-ffgj No score

Duplicate Advisory: Command injection in Weblate

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references.

Original Description

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.

Record
GHSA-h2g5-2rhx-ffgj
Weakness
CWE-77
Updated
2026-11-02
OSVPYSEC-2022-162 No score

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.

Record
PYSEC-2022-162
Updated
2026-11-02
OSVPYSEC-2022-31 No score

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Record
PYSEC-2022-31
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
weblate
PyPI
 before 4.11.1
4.11.1
weblate
Bitnami
From an advisory covering 2 CVEs
 before 4.11.1
4.11.1
weblate
PyPI
From an advisory covering 2 CVEs
 before 4.11.1, plus listed versions
1.92.02.12.102.10.1
Show 45 moreShow less
2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.93.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.63.6.13.73.7.1
4.11.1

History

History
RecordedChangedSources
affected, facts
affected
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23915 is a high vulnerability (CVSS 7.2) in Weblate, published March 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.10%, the 87th percentile. Fixed in weblate 4.11.1.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 36 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open