Vulnerability · Published Feb 18, 2026 · Assigned by GitHub_M
CVE-2026-24126Weblate has an argument injection in management console
Medium 6.6
In plain English
A medium-severity argument injection in weblate from WeblateOrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | weblate | 5.16.0 | GHSA-33fm-6gp7-4p47 |
| PyPI | weblate | 5.16 | PYSEC-2026-2309 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WeblateOrg | weblate | < 5.16.0 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47 x_refsource_CONFIRM
- https://github.com/WeblateOrg/weblate/pull/17722 x_refsource_MISC
- https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd x_refsource_MISC