Remote Code Execution (RCE)

poetrycore is vulnerable to remote code execution. The vulnerability exists in git.py when the application runs on Windows because the file hashes are not checked before installation which allows an attacker to inject and execute poetry commands...

Command Injection

Weblate is vulnerable to command injection. The vulnerability exists in clone and getremotebranch functions in mercurial.py and git.py respectively because some arguments are not sanitize which allows an attacker to inject and execute arbitrary commands...