CVE-2026-86035: Weblate Argument Injection RCE Vulnerability

CVE-2026-86035 Overview

CVE-2026-86035 is an argument-injection vulnerability in the Mercurial backend of Weblate, a web-based continuous localization platform used to manage software translations. Affected versions include Weblate 4.11.1 through 2026.7.1. Repository filenames beginning with a dash can be interpreted as Mercurial command-line options instead of literal paths. An authenticated user holding the component.edit permission on a Mercurial-backed RESX component can abuse the Update RESX files add-on to trigger arbitrary command execution during a later repository update. The commands run with the privileges of the Weblate service account. This flaw is a residual, incomplete fix for CVE-2022-23915 and is tracked under [CWE-78] OS Command Injection.

Critical Impact
Authenticated attackers with project-scoped component edit rights can achieve arbitrary command execution as the Weblate service account, leading to full compromise of the Weblate host.

Affected Products

Weblate 4.11.1 through 2026.7.1
Weblate instances configured with Mercurial-backed RESX components
Weblate deployments enabling the Update RESX files add-on

Discovery Timeline

2026-09-29 - CVE-2026-86035 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-86035

Vulnerability Analysis

Weblate integrates with version control systems, including Mercurial, to synchronize translation files. The Mercurial backend in weblate/vcs/mercurial.py passes filenames to the hg command line without terminating option parsing. When a filename begins with -, Mercurial treats the value as an option flag rather than a path argument. This behavior enables argument injection into Mercurial subcommands executed by the Weblate service.

An authenticated user with component.edit permission on a Mercurial-backed RESX component can create translation files whose names start with -. The Update RESX files add-on later stages these files, and when Weblate invokes Mercurial to commit or update the repository, the injected options are interpreted by hg. Certain Mercurial options can execute external programs or hooks, resulting in arbitrary command execution under the Weblate service account.

Root Cause

The root cause is missing argument separator handling in the Mercurial VCS wrapper. Weblate did not insert the -- end-of-options marker before user-controlled filenames when constructing hg command lines. This is the same class of defect addressed for other VCS backends in CVE-2022-23915, but the Mercurial path was not fully remediated.

Attack Vector

Exploitation requires an authenticated Weblate account with project-scoped component.edit permission on a Mercurial-backed component that uses the Update RESX files add-on. The attacker submits or renames a RESX file so its name begins with -. On the next repository operation, the injected Mercurial option is evaluated and arbitrary commands run with the privileges of the Weblate service account.

python

# Security patch excerpt from weblate/vcs/mercurial.py
# Source: https://github.com/WeblateOrg/weblate/commit/f60a9759a6d851bd10ccdefe9b1b7f0cdb9e9bbd

        # Add files one by one, this has to deal with
        # removed, untracked and non existing files
        commit_files = []
        if files is not None:
            for name in files:
                try:

The patch introduces safe handling of Mercurial filenames beginning with a dash by terminating path options before user-supplied names are passed to hg.

Detection Methods for CVE-2026-86035

Indicators of Compromise

Presence of files in Mercurial-backed component repositories whose names begin with -
Unexpected child processes spawned by the Weblate service account, particularly shells or network utilities launched from hg invocations
Audit log entries showing component edits or add-on configuration changes by low-privilege accounts on Mercurial-backed RESX components
Outbound network connections originating from the Weblate worker or Celery processes to unfamiliar hosts

Detection Strategies

Inspect all Mercurial working trees managed by Weblate for filenames matching the pattern ^-
Correlate Weblate audit logs against process execution telemetry to identify component updates immediately followed by unusual hg command lines
Review Update RESX files add-on activity for components not previously using RESX formats

Monitoring Recommendations

Enable command-line logging for the Weblate service account and alert on hg invocations containing suspicious flag-like arguments
Monitor Weblate application logs for repository update failures or unusual add-on execution errors
Track privileged operations on Mercurial-backed components using centralized log aggregation and retention

How to Mitigate CVE-2026-86035

Immediate Actions Required

Upgrade Weblate to version 2026.8 or later, which contains the patched Mercurial backend
Audit existing Mercurial-backed components for filenames starting with - and remove any unexpected entries
Review users granted component.edit permission on Mercurial-backed RESX components and revoke unnecessary access
Rotate credentials and secrets accessible to the Weblate service account if exploitation is suspected

Patch Information

The fix is included in Weblate 2026.8. Relevant references include the GitHub Security Advisory GHSA-327h-qqgm-qv55, the remediation commit, Pull Request #20768, and the weblate-2026.8 release.

Workarounds

Migrate affected components from Mercurial to Git backends until the upgrade is applied
Disable the Update RESX files add-on on Mercurial-backed components
Restrict component.edit permission on Mercurial-backed components to trusted administrators only
Run the Weblate service account with least privilege and isolate it using sandboxing or containerization

bash

# Upgrade Weblate to the patched release
pip install --upgrade 'Weblate==2026.8'

# Identify unsafe filenames in Mercurial-backed component repositories
find /var/lib/weblate/vcs -type f -name '-*' -print