CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.

• CWE-78
• CWE-88

• https://github.com/WeblateOrg/weblate/commit/f60a9759a6d851bd10ccdefe9b1b7f0cdb9e9bbd
• https://github.com/WeblateOrg/weblate/pull/20768
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.8
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-327h-qqgm-qv55

Published

Sep 29, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85995Notepad++ is a free and open-source source code editor. From…7.3
• CVE-2026-85999Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86000Soup Sieve is a CSS selector library designed to be used wit…5.3
• CVE-2026-86003CoreDNS is a DNS server written in Go. Prior to 1.14.7, the …7.5
• CVE-2026-8602In ScadaBR version 1.2.0, a Missing Authentication for Criti…9.1
• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8
• CVE-2026-86038libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86039libp2p is a JavaScript implementation of the libp2p networki…8.2
• CVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow a…8.8
• CVE-2026-86040libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-86049Jupyter Server is the backend for Jupyter web applications. …7.1