Nixpkgs security tracker
Untriaged
Permalink
CVE-2025-68398
9.1 CRITICAL
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
Activity log
- Created suggestion
Weblate has git config file overwrite vulnerability that leads to remote code execution
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
References
-
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3 x_refsource_CONFIRM
-
https://github.com/WeblateOrg/weblate/pull/17330 x_refsource_MISC
-
https://github.com/WeblateOrg/weblate/pull/17345 x_refsource_MISC
-
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1 x_refsource_MISC
Affected products
weblate
- ==< 5.15.1
Matching in nixpkgs
pkgs.weblate
Web based translation tool with tight version control integration
pkgs.python312Packages.weblate-schemas
Schemas used by Weblate
-
nixos-unstable 2025.2
pkgs.python313Packages.weblate-schemas
Schemas used by Weblate
pkgs.python314Packages.weblate-schemas
Schemas used by Weblate
pkgs.python312Packages.weblate-language-data
Language definitions used by Weblate
-
nixos-unstable 2025.8
pkgs.python313Packages.weblate-language-data
Language definitions used by Weblate
pkgs.python314Packages.weblate-language-data
Language definitions used by Weblate
Package maintainers
-
@erictapen Kerstin Humm <kerstin@erictapen.name>