CVE-2026-24126

Katalog CVE

CVSS 9.1 · Critical EPSS 0,49%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada weblate. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47 patch · advisory vendor
• https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd patch
• https://github.com/WeblateOrg/weblate/pull/17722 issue tracking