CVE-2026-24126
Weblate has an argument injection in management console
CVSS Score
6.6
EPSS Score
0.0%
EPSS Percentile
0th
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
| CWE | CWE-88 |
| Vendor | weblateorg |
| Product | weblate |
| Published | Feb 18, 2026 |
| Last Updated | Feb 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for weblateorg weblate
Be the first to know when new medium vulnerabilities affecting weblateorg weblate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
WeblateOrg / weblate
< 5.16.0