{"action":"Upgrade weblate to 4.11.1 or later.","affected":[{"fixed":"4.11.1","introduced":"0"}],"component":"weblate","cve_ids":["CVE-2022-23915","CVE-2022-24727"],"ecosystem":"PyPI","epss":0.03099,"exploited":false,"fixed_versions":["4.11.1"],"ghsa_id":"GHSA-3872-f48p-pxqj","id":"tcs_01M5KGH3XXN0PKZ120K7XGHX2Z","modified_at":"2023-12-06T01:02:02.756846Z","published_at":"2022-03-04T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-31","https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088","https://github.com/WeblateOrg/weblate/pull/7338","https://github.com/WeblateOrg/weblate/pull/7337","https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-31","url":"https://osv.dev/vulnerability/PYSEC-2022-31"}],"summary":"The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior"}