Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M

CVE-2026-86035Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

High 8.5

In plain English

A high-severity OS command injection in weblate from WeblateOrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.5%top 59.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.

Affected products (as reported)

VendorProductVersions
WeblateOrg weblate >= 4.11.1, < 2026.8

Weakness: CWE-78, CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References