PyPI/weblate CVE-2022-23915, CVE-2022-24727: unknown, EPSS 3.10%

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to

Action: Upgrade weblate to 4.11.1 or later.

pip install weblate==4.11.1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-162
• https://github.com/WeblateOrg/weblate/commit/35d59f1f040541c358cece0a8d4a63183ca919b8
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3872-f48p-pxqj
• https://github.com/WeblateOrg/weblate/commit/d83672a3e7415da1490334e2c9431e5da1966842
• https://github.com/advisories/GHSA-h2g5-2rhx-ffgj

CVE-2022-23915, CVE-2022-24727 · published 2022-03-04T17:15:00Z · modified 2023-12-06T01:02:02.756846Z · JSON