{"id":"CVE-2026-24126","aliases":["GHSA-33fm-6gp7-4p47","PYSEC-2026-2309"],"title":"Weblate has an argument injection in management console","summary":"Weblate has an argument injection in management console","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate < 5.16.0"],"patched":["weblate 5.16.0"],"published":"2026-02-17","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-33fm-6gp7-4p47","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-33fm-6gp7-4p47"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24126"},{"url":"https://github.com/WeblateOrg/weblate/pull/17722"},{"url":"https://github.com/WeblateOrg/weblate/commit/78773cc141ce0a97900c11341e6cf856451395fd"},{"url":"https://github.com/WeblateOrg/weblate"}],"tags":["osv","pip","exploit-available"],"epss":0.00465,"epssPercentile":0.39475,"ingestedAt":"2026-07-13T18:57:51.600Z","exploits":{"github":1,"githubRepos":["https://github.com/alexb616/Weblate-CVE-2026-24126"],"checkedAt":"2026-09-24T07:53:01.056Z"},"exploitAvailable":true,"slug":"CVE-2026-24126","body":"## Overview\n\n### Impact\nThe SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/17722\n\n### Workarounds\nProperly limit access to the management console.\n\n### References\nThis issue was reported to us by [alexb_616](https://hackerone.com/alexb_616) via HackerOne.\n\n## Affected packages\n\n- `weblate < 5.16.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 5.16.0`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":36.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5028,"id":"CVE-2026-24126","ts":1788887229569,"field":"exploit_available","old":"false","new":"true"},{"seq":3911,"id":"CVE-2026-24126","ts":1788886360312,"field":"exploit_available","old":"true","new":"false"},{"seq":2733,"id":"CVE-2026-24126","ts":1788883026126,"field":"exploit_available","old":"false","new":"true"},{"seq":1762,"id":"CVE-2026-24126","ts":1788882430104,"field":"exploit_available","old":"true","new":"false"},{"seq":868,"id":"CVE-2026-24126","ts":1788881863098,"field":"exploit_available","old":"false","new":"true"}]}