CVE-2026-24126
Medium · 6.6CVSS
6.6
EPSS
0.5%
Published
Feb 19, 2026
CISA due date
—
The record
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | weblate | 0 | 5.16.0 |
Related vulnerabilities
- GHSA-33fm-6gp7-4p47 Weblate has an argument injection in management console Same vulnerability
- CVE-2026-27457 Weblate is a web based localization tool. Also affects weblate
- GHSA-wppc-7cq7-cgfv Weblate: Missing access control for the AddonViewSet API exposes all addon configurations Also affects weblate
- GHSA-3g2f-4rjg-9385 Weblate leaks information via screenshots Also affects weblate
- CVE-2026-21889 Weblate leaks information via screenshots Also affects weblate
- GHSA-8vcg-cfxj-p5m3 Weblate is vulnerable to RCE through Git config file overwrite Also affects weblate
- CVE-2025-68398 Weblate is a web based localization tool. Also affects weblate
- GHSA-g925-f788-4jh7 Weblate has an arbitrary file read via symbolic links Also affects weblate