High severity · published Mar 4, 2022
CVE-2022-23915
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories
8.8
CVSS
3.1%
EPSS
No
On KEV
Description
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Weblate · Weblate
before 4.11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23915
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23915
Patch
https://github.com/WeblateOrg/weblate/pull/7337
Patch
https://github.com/WeblateOrg/weblate/pull/7338
Patch
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1
Patch
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088
More from Weblate
9.8
CVE-2025-64725
Weblate is a web based localization tool
9.1
CVE-2026-24126
Weblate has an argument injection in management console
9.1
CVE-2025-68398
Weblate is a web based localization tool
8.8
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
8.1
CVE-2026-41654
Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url