CVE-2022-24727
Duplicate Advisory: Command injection in Weblate
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedGHSA-3872-f48p-pxqj
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate
Impact
Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.
Patches
The issues were fixed in the 4.11.1 release. The following commits are addressing it:
- 35d59f1f040541c358cece0a8d4a63183ca919b8
- d83672a3e7415da1490334e2c9431e5da1966842
Workarounds
Instances in which untrusted users cannot create new components are not affected.
References
For more information
If you have any questions or comments about this advisory:
- Open a topic in discussions
- Email us at [email protected]
- Record
GHSA-3872-f48p-pxqj- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-88
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2022-24727- Updated
- 2026-11-02
EUVDEUVD-2022-55959 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
EUVD-2022-55959- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h2g5-2rhx-ffgj No score
Duplicate Advisory: Command injection in Weblate
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references.
Original Description
Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.
- Record
GHSA-h2g5-2rhx-ffgj- Weakness
- CWE-77
- Updated
- 2026-11-02
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-23915. Reason: This candidate is a reservation duplicate of CVE-2022-23915. Notes: All CVE users should reference CVE-2022-23915 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2022-24727- Updated
- 2026-11-02
OSVCVE-2022-23915
Remote Code Execution (RCE)
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
- Record
CVE-2022-23915- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVBIT-weblate-2022-23915 No score
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
- Record
BIT-weblate-2022-23915- Updated
- 2026-11-02
OSVGHSA-h2g5-2rhx-ffgj No score
Duplicate Advisory: Command injection in Weblate
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3872-f48p-pxqj. This link is maintained to preserve external references.
Original Description
Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.
- Record
GHSA-h2g5-2rhx-ffgj- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVPYSEC-2022-162 No score
Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.
- Record
PYSEC-2022-162- Updated
- 2026-11-02
OSVPYSEC-2022-31 No score
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
- Record
PYSEC-2022-31- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
weblateBitnami From an advisory covering 2 CVEs |
before 4.11.1 | 4.11.1 |
weblatePyPI From an advisory covering 2 CVEs |
before 4.11.1, plus listed versions 1.92.02.12.102.10.1 Show 45 moreShow less2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.93.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.63.6.13.73.7.1 |
4.11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24727 has been rejected by its source and should not be treated as a live vulnerability, published March 4, 2022.
References
github.com/WeblateOrg/weblate/security/advisories/GHSA-3872-f48p-pxqj
nvd.nist.gov/vuln/detail/CVE-2022-24727
Show 9 moreShow less
snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
Left out here: 36 versions. The JSON record has them.