CVE-2022-23915: Remote Code Execution in weblate
Summary
CVE-2022-23915: The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Affects weblate versions < 4.11.1. Fixed in 4.11.1. How to fix ↓
Also tracked for
- weblate · Bitnami
The same CVE-2022-23915 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
weblate is a package available on PyPI that provides a web-based translation tool for various projects. It allows users to manage translations, collaborate with others, and track the progress of translation efforts. The package is widely used in open-source projects and provides support for git and mercurial repositories. However, versions 0 to 4.11.1 of weblate are vulnerable to Remote Code Execution (RCE) through argument injection when using git or mercurial repositories. This vulnerability allows authenticated users to manipulate the application's behavior in unintended ways, potentially leading to the execution of arbitrary commands.
Vulnerability Detail
The vulnerability in weblate arises from a lack of proper input validation when handling arguments in git or mercurial repositories. By injecting specially crafted arguments, authenticated users can modify the behavior of the application and execute arbitrary commands. This can result in unauthorized access to sensitive information, data loss, or even complete compromise of the affected system. The vulnerability has been assigned the identifier CVE-2022-23915 and is tracked in the PyPI advisory database as PYSEC-2022-31.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11.1
This is the first release that contains the fix.
pip install --upgrade "weblate==4.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the use of git or mercurial repositories in weblate until the package is updated to a fixed version. This can be achieved by modifying the configuration to use alternative repository types or by temporarily disabling repository integration in the application. However, this workaround may limit certain functionality provided by weblate.
Conclusion
The vulnerability in weblate versions 0 to 4.11.1 exposes users to the risk of remote code execution through argument injection in git or mercurial repositories. To mitigate this risk, it is crucial to upgrade to weblate version 4.11.1 or later. In the meantime, users can consider implementing the provided workaround to disable the use of vulnerable repository types. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for weblate →
FAQ
The vulnerability allows authenticated users to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data loss, or complete compromise of the system.
Any user or organization using weblate versions 0 to 4.11.1 with git or mercurial repositories enabled is affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fixes as soon as possible to mitigate the risk.
The CVSS score for this vulnerability has not been provided in the available information. It is recommended to refer to the official CVE entry or advisory for the most up-to-date information.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
