medium6.6
CVE-2026-24126
Weblate has an argument injection in management console
Impact
### Impact The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. ### Patches * https://github.com/WeblateOrg/weblate/pull/17722 ### Workarounds Properly limit access to the management console. ### References This issue was reported to us by [alexb_616](https://hackerone.com/alexb_616) via HackerOne.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Weblate | < 5.16.0 | 5.16.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Weblate | Weblate | before 5.16 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd
- https://github.com/WeblateOrg/weblate/pull/17722
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47
- https://github.com/advisories/GHSA-33fm-6gp7-4p47
- https://nvd.nist.gov/vuln/detail/CVE-2026-24126