Executive brief
Weblate is a web-based translation management platform. The SSH management console feature fails to validate user input when adding SSH host keys, allowing authenticated administrators to inject arbitrary arguments into the underlying ssh-add command. An attacker with console access could potentially read sensitive SSH key material or modify system configuration.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in Weblate's SSH management console. When adding an SSH host key, user-supplied input is not properly validated or sanitized before being passed to the ssh-add command, allowing an attacker to inject arbitrary command-line arguments. The attack requires authentication and administrative privilege to access the management console (PR:H), and the network vector allows remote exploitation (AV:N). An attacker can exploit this to inject flags that may leak confidential data such as SSH key material. The vulnerability was patched in version 5.16.0 via PR #17722.
Affected products
- Weblate Weblate before 5.16.0
Timeline
- 2026-02-17: disclosed
- 2026-02-17: patched: Fixed in version 5.16.0