CVE-2022-24727: Command injection in Weblate
Summary
CVE-2022-23915: Command injection in Weblate. Affects weblate versions < 4.11.1. Fixed in 4.11.1. How to fix ↓
Also tracked for
- weblate · Bitnami
The same CVE-2022-23915 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is a web-based localization tool with tight version control integration. It allows users to manage and translate their software projects efficiently. Weblate integrates with Git and Mercurial for version control. Prior to version 4.11.1, Weblate did not properly sanitize certain arguments passed to Git and Mercurial, which could lead to command injection vulnerabilities. This vulnerability could be exploited by untrusted users to change the behavior of Git and Mercurial in unintended ways. It is important to note that instances where untrusted users cannot create new components are not affected by this vulnerability.
Vulnerability Detail
The vulnerability in Weblate arises from the lack of proper sanitization of arguments passed to Git and Mercurial. This allows untrusted users to inject malicious commands, potentially leading to unauthorized access, data manipulation, or denial of service. The impact of this vulnerability depends on the privileges of the user executing the injected commands. Weblate version 4.11.1 addresses this issue by implementing proper sanitization of the affected arguments.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.1
This is the first release that contains the fix.
pip install --upgrade "weblate==4.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
The command injection vulnerability in Weblate prior to version 4.11.1 can be mitigated by upgrading to the latest version. It is important to promptly apply the fix to ensure the security of your Weblate installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for weblate →
FAQ
Weblate is a web-based localization tool used for managing and translating software projects.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a system by injecting malicious input into a command that is executed by the system.
Instances of Weblate prior to version 4.11.1 are affected by this vulnerability. However, instances where untrusted users cannot create new components are not affected.
An attacker exploiting this vulnerability can potentially execute arbitrary commands on the system, leading to unauthorized access, data manipulation, or denial of service.
To mitigate this vulnerability, it is recommended to upgrade to Weblate version 4.11.1 or later, which includes the necessary fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
