PyPI/weblate CVE-2022-23915, CVE-2022-24727: unknown, EPSS 3.10%

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior

Action: Upgrade weblate to 4.11.1 or later.

pip install weblate==4.11.1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-31
• https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
• https://github.com/WeblateOrg/weblate/pull/7338
• https://github.com/WeblateOrg/weblate/pull/7337
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1

CVE-2022-23915, CVE-2022-24727 · published 2022-03-04T20:15:00Z · modified 2023-12-06T01:02:02.756846Z · JSON