Source: wlc Version: 2.0.0-1 Severity: important Tags: security upstream Forwarded: https://github.com/WeblateOrg/wlc/pull/1500 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for wlc. CVE-2026-62364[0]: | wlc is a Weblate command-line client using Weblate's REST API. Prior | to 2.0.1, automatically discovered configuration from .weblate, | .weblate.ini, or weblate.ini can select the API URL while an | unscoped API token is supplied through WLC_KEY or --key without a | matching WLC_URL or --url. When wlc runs in an untrusted repository, | pull request checkout, or directory with untrusted ancestor | configuration, it can send the token to an attacker-controlled | project-configured URL. URL-scoped keys in [keys] are not affected. | This issue is fixed in version 2.0.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-62364 https://www.cve.org/CVERecord?id=CVE-2026-62364 [1] https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc [2] https://github.com/WeblateOrg/wlc/pull/1500 [3] https://github.com/WeblateOrg/wlc/commit/055fd2d43d0f72418b459286245330f08176db62 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
