CyberRota Analysis
AI-GeneratedThe Weblate command-line client, prior to version 2.0.1, is vulnerable to exposure of API tokens when running in untrusted environments, allowing attackers to potentially intercept tokens sent to maliciously configured URLs. This vulnerability primarily affects users who utilize the client in environments where repository trust cannot be guaranteed, such as pull request checkouts. Organizations using this client should prioritize updating to version 2.0.1 to mitigate the risk of unauthorized access to their API tokens.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.