Medium
Weblate has an argument injection in management console
Type: advisorySources: OSV
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-24126
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:18 UTC · Revision 1
Source evidence
Weblate has an argument injection in management console
core-osv · Original sourcePublished 18 Feb 2026, 23:05 UTC
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
osv:CVE-2026-24126
Complete source record
{
"id": "06e1d2b4842293fccfdee03fb3a7b39a00a8d970ea5eb2a191d88477228f84e0",
"url": "https://osv.dev/vulnerability/CVE-2026-24126",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Weblate has an argument injection in management console",
"summary": "Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.",
"evidence": "osv:CVE-2026-24126",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-24126",
"aliases": [
"CVE-2026-24126",
"GHSA-33fm-6gp7-4p47",
"PYSEC-2026-2309"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/weblateorg/weblate",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8c5aad0ba7a2517096b4a65eccfa9af363b99ad3"
},
{
"fixed": "78773cc141ce0a97900c11341e6cf856451395fd"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.16"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "78773cc141ce0a97900c11341e6cf856451395fd"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"weblate-5.15.2",
"weblate-5.15.1",
"weblate-5.15",
"weblate-5.14.1",
"weblate-5.14",
"weblate-5.13.2",
"weblate-5.13.1",
"weblate-5.13",
"weblate-5.12.2",
"weblate-5.12.1",
"weblate-5.12",
"weblate-5.11.1",
"weblate-5.11",
"weblate-5.10.3",
"weblate-5.10.2",
"weblate-5.10.1",
"weblate-5.10",
"weblate-5.9.2",
"weblate-5.9.1",
"weblate-5.9",
"weblate-5.8.2",
"weblate-5.8.1",
"weblate-5.8",
"weblate-5.7.2",
"weblate-5.7.1",
"weblate-5.7",
"weblate-5.6.1",
"weblate-5.6",
"weblate-5.5.5",
"weblate-5.5.4",
"weblate-5.5.3",
"weblate-5.5.2",
"weblate-5.5.1",
"weblate-5.5",
"weblate-5.4",
"weblate-5.3",
"weblate-5.2.1",
"weblate-5.2",
"weblate-5.1.1",
"weblate-5.1",
"weblate-5.0.2",
"weblate-5.0.1",
"weblate-4.18.1",
"weblate-4.18",
"weblate-4.17",
"weblate-4.16.2",
"weblate-4.16.1",
"weblate-4.16",
"weblate-4.15.1",
"weblate-4.15",
"weblate-4.14.2",
"weblate-4.14.1",
"weblate-4.14",
"weblate-4.13.1",
"weblate-4.13",
"weblate-4.12.1",
"weblate-4.12",
"weblate-4.11.2",
"weblate-4.11.1",
"weblate-4.11",
"weblate-4.10.1",
"weblate-4.10",
"weblate-4.9.1",
"weblate-4.9",
"weblate-4.8.1",
"weblate-4.8",
"weblate-4.7.2",
"weblate-4.7.1",
"weblate-4.7",
"weblate-4.6",
"weblate-4.5.2",
"weblate-4.5.1",
"weblate-4.5",
"weblate-4.4.1",
"weblate-4.4",
"weblate-4.3.2",
"weblate-4.3.1",
"weblate-4.3",
"weblate-4.2.1",
"weblate-4.2",
"weblate-4.1.1",
"weblate-4.1",
"weblate-4.0.2",
"weblate-4.0.1",
"weblate-4.0",
"weblate-3.11.1",
"weblate-3.11",
"weblate-3.10.2",
"weblate-3.10.1",
"weblate-3.10",
"weblate-3.9.1",
"weblate-3.9",
"weblate-3.8",
"weblate-3.7.1",
"weblate-3.7",
"weblate-3.6.1",
"weblate-3.6",
"weblate-3.5.1",
"weblate-3.5",
"weblate-3.4",
"weblate-3.3",
"weblate-3.2.1",
"weblate-3.2",
"weblate-3.1.1",
"weblate-3.1",
"weblate-3.0.1",
"weblate-3.0",
"weblate-2.20",
"weblate-2.19.1",
"weblate-2.19",
"weblate-2.18",
"weblate-2.17",
"weblate-2.16",
"weblate-2.15",
"weblate-2.14.1",
"weblate-2.14",
"weblate-2.13.1",
"weblate-2.13",
"weblate-2.12",
"weblate-2.11",
"weblate-2.10",
"weblate-2.9",
"weblate-2.8",
"weblate-2.7",
"weblate-2.5",
"weblate-2.4",
"weblate-2.3",
"weblate-2.2",
"weblate-2.1",
"weblate-1.9",
"weblate-1.8",
"weblate-1.7",
"weblate-1.6",
"weblate-1.5",
"weblate-1.4",
"weblate-1.3",
"weblate-1.2",
"weblate-1.1",
"weblate-1.0",
"weblate-0.9",
"weblate-0.8",
"weblate-0.6",
"weblate-0.5",
"weblate-0.3",
"weblate-0.2",
"weblate-0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24126.json"
}
}
],
"modified": "2026-10-28T02:30:33.078727197Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24126.json",
"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47",
"https://nvd.nist.gov/vuln/detail/CVE-2026-24126",
"https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd",
"https://github.com/WeblateOrg/weblate/pull/17722"
],
"provider_metadata": {
"cwe_ids": [
"CWE-88"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "5.16.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
},
{
"extracted_events": [
{
"range": [
{
"fixed": "5.16.0"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24126.json"
}
},
"related_cves": [
{
"value": "CVE-2026-24126",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499989,
"published_at": "2026-02-18T23:05:03.478+00:00"
}