Open-source package vulnerability · PyPI
CVE-2025-68398: Weblate is vulnerable to RCE through Git config file overwrite
criticalCVSS 3.1 9.1GHSA-8vcg-cfxj-p5m3
Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure.
Published Dec 18, 2025 · Updated Feb 6, 2026
Affected packages
Weblate
- Ecosystem
- PyPI
- Affected
- < 5.15.1
- Fixed in
- 5.15.1
- Check
pip show Weblate
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
It was possible to overwrite Git configuration remotely and override some of its behavior.
Resources
Thanks to Jason Marcello for responsible disclosure.
Credited to secjson, nijel.
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
- https://github.com/WeblateOrg/weblate/pull/17330
- https://github.com/WeblateOrg/weblate/pull/17345
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
- https://nvd.nist.gov/vuln/detail/CVE-2025-68398
- https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
- https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
- https://github.com/advisories/GHSA-8vcg-cfxj-p5m3
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology