Command Injection

Weblate is vulnerable to command injection. The vulnerability exists in clone and getremotebranch functions in mercurial.py and git.py respectively because some arguments are not sanitize which allows an attacker to inject and execute arbitrary commands...

Remote Code Execution (RCE)

weblate, is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the checkconfig function in the mercurial.py file allowing a malicious user to execute command via argument injection to crash the system...