Weblate’s SSH management console fails to validate user input when adding an SSH host key, allowing an attacker to inject arbitrary arguments to the underlying ssh-add command. This argument injection can grant the attacker the ability to execute unintended commands within the context of the Weblate application, thereby exposing the host system to remote code execution. The weakness is classified as CWE‑88.

All releases of Weblate by WeblateOrg that are older than version 5.16.0 are affected. No specific patch versions are listed; any instance running before the 5.16.0 release is vulnerable.

The CVSS score of 6.6 indicates moderate severity. The EPSS score is reported as less than 1 %, showing a very low probability of exploitation, and the vulnerability is not currently listed in the KEV catalog. Exploitation requires authenticated access to the Weblate SSH management console, as the injection occurs through the console’s input handling. Because the vulnerability is tied to a feature that is not commonly exposed, the attack vector is limited, but the potential impact remains significant if an attacker gains access to the console.