CVE-2026-86035

Executive Summary

CVE-2026-86035 is an argument-injection (OS command injection, CWE-78) vulnerability in the Mercurial backend of Weblate, a web-based continuous localization platform. Versions 4.11.1 through 2026.7.1 are affected. An authenticated user holding project-scoped component.edit permission can cause arbitrary command execution with the privileges of the Weblate service account after a subsequent repository update, representing a residual, incomplete fix for CVE-2022-23915. The vulnerability carries a CVSS 3.1 base score of 8.5 (High), with High confidentiality, integrity, and availability impact.

Technical Analysis

Weblate manages translation repositories backed by multiple version control systems, including Mercurial. The vulnerability resides in how the Mercurial backend constructs command-line invocations. When Weblate passes repository filenames to the Mercurial client, filenames beginning with a hyphen (-) are not disambiguated as literal paths. Most command-line tools, including Mercurial, interpret arguments beginning with - as options rather than positional operands unless a path separator or an explicit option terminator is supplied.

The NVD description states: "Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths." This is the classic argument-injection pattern: attacker-controlled input is concatenated into an argument vector without neutralization, allowing the input to be parsed as command-line flags. Because some Mercurial options can themselves specify external programs or hooks to execute, an attacker who can create or influence a repository filename can smuggle such options into the Mercurial invocation.

The attacker prerequisite is an authenticated user with project-scoped component.edit permission. The described exploitation vector is a Mercurial-backed RESX component combined with the "Update RESX files" add-on. The description indicates that a later repository update triggers the dangerous Mercurial invocation, meaning execution is deferred until Weblate performs a subsequent repository operation rather than occurring at file-creation time. The privilege boundary is notable: the CVSS vector sets scope as Changed (S:C) and privileges required as Low (PR:L), reflecting that a restricted project editor can escalate to code execution under a different security authority — the Weblate service account — which may hold broader access to the host, database, and other projects' repositories.

This is explicitly characterized as a "residual incomplete fix for CVE-2022-23915," indicating that the original CVE-2022-23915 remediation did not comprehensively cover all argument-injection sinks in the Mercurial backend. The patch confidence for this report is 0/4 (unpatched per tracked-source evidence); however, the NVD description states the issue "has been patched in version 2026.8." No vendor advisory reference, commit hash, or diff was supplied in the provided data, so the exact code change cannot be confirmed from available sources.

Attack surface considerations:

• Ingestion point: repository filenames within a Mercurial-backed component (RESX type) configured with the "Update RESX files" add-on.
• Trigger point: a subsequent repository update operation performed by Weblate.
• Execution context: the Weblate service account, which typically has read/write access to a persistent data volume and database credentials.
• Authentication requirement: a valid session with component.edit scoped to a project.

No public PoC, exploit code, or Nuclei template is available, and the CVE is not listed in CISA KEV. The attack chain below is therefore described at the vulnerability-class level, inferred from the argument-injection mechanism and the NVD description.

Exploitation Scenarios

No public PoC is available; the following chain is inferred strictly from the NVD description and the argument-injection vulnerability class. Only entities named in the description are referenced.

1. Reconnaissance / target identification An attacker identifies a Weblate instance (for example, via Shodan dorks against the Weblate web interface) and obtains or already possesses credentials for a user with project-scoped component.edit permission. The attacker enumerates projects containing Mercurial-backed components and identifies one configured with the "Update RESX files" add-on.

2. Triggering the argument-injection flaw Leveraging the component.edit permission on a Mercurial-backed RESX component, the attacker introduces a repository filename beginning with -. Because the Mercurial backend does not treat such a filename as a literal path, the value is parsed as a Mercurial option once the repository is processed. This is the argument-injection primitive: attacker-influenced data crosses from a filename (data) into the command-line option namespace (control).

3. Payload / execution The malicious filename delivers an option-shaped token instead of a path. When Weblate subsequently performs a repository update, the Mercurial invocation interprets the injected token as an option, yielding command execution under the Weblate service account. Per the NVD description, execution manifests on "a later repository update," so the attacker stages the filename and waits for the next repository-update cycle. No specific Mercurial option names or function identifiers are provided in the source data and none are asserted here.

4. Post-exploitation impact Arbitrary command execution with the privileges of the Weblate service account. Because the service account commonly owns translation repositories and holds configuration and database access, successful exploitation can compromise the confidentiality, integrity, and availability of all translations managed by the instance. CVSS rates C/I/A as High and scope as Changed, reflecting potential lateral movement beyond the originally authorized project. Because the flaw is an incomplete fix for CVE-2022-23915, environments that were remediated for the original CVE should not be assumed protected.

Impact Assessment

Business impact: Weblate is frequently deployed as a self-hosted localization hub holding proprietary product strings, credentials in configuration, and access to source repositories. Command execution under the service account can lead to data exfiltration, tampering with translations (a supply-chain risk if translations ship in builds), and persistence on the host.

Affected systems: Weblate 4.11.1 through 2026.7.1 with the Mercurial backend and the RESX "Update RESX files" add-on enabled. Instances using only Git or other backends are not described as affected.

Blast radius and CVSS subscores (8.5 High, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H):

• AV:N — reachable over the network via the Weblate web interface.
• AC:H — High attack complexity, likely reflecting the need for a suitable Mercurial-backed component configuration and a deferred repository-update event.
• PR:L — Low privileges required: an authenticated user with component.edit.
• UI:N — no user interaction.
• S:C — scope Changed: impact crosses from the project-editor boundary to the Weblate service account and host.
• C:H / I:H / A:H — High across confidentiality, integrity, and availability.

Detection Guidance

Sigma Rule

title: Weblate Mercurial Backend Argument Injection Exploitation Attempt (CVE-2026-86035)
id: 8f2c1a44-6b2e-4d3a-9c77-2f0e1b6a9d10
status: experimental
description: Detects creation or modification of Mercurial repository files whose names begin with a hyphen within Weblate-managed repositories, indicative of argument-injection staging for CVE-2026-86035.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86035
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
  - cve.2026-86035
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains: '/weblate/'
  selection_dash:
    TargetFilename|re: '/-[\w-]+(\.resx|\.hg|/|$)'
  selection_marker:
    TargetFilename|contains:
      - '.hg/'
      - 'REPOSITORY'
  condition: selection_path and selection_dash and selection_marker
falsepositives:
  - Legitimate Mercurial repositories containing files that start with a hyphen (rare)
level: high

YARA Rule

rule CVE_2026_86035_Weblate_Mercurial_Argument_Injection
{
    meta:
        description = "Detects hyphens-prefixed repository filenames staged for Mercurial argument injection in Weblate-managed repositories (CVE-2026-86035)"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86035"
        severity = "high"

    strings:
        $resx = ".resx" ascii nocase
        $web = "Weblate" ascii nocase
        $addon = "Update RESX files" ascii nocase
        $hg = ".hg" ascii
        $dash = "-"

    condition:
        uint16(0) == 0x685F or
        (any of ($resx, $web, $addon, $hg) and 2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-86035 Weblate Mercurial Argument Injection - Suspicious Filename Leading Hyphen"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"weblate"; nocase; content:"filename="; nocase; pcre:"/filename[=:][\x22']?-/i"; reference:cve,2026-86035; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86035; classtype:attempted-admin; sid:2026860350; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("hg", "mercurial") and
  process.args : "*--*" and
  process.args : "*.resx*" and
  process.parent.name in ("python", "python3", "uwsgi", "celery", "gunicorn")

Splunk SPL Query

index=weblate sourcetype=weblate:* OR sourcetype=linux_audit
| search ("component.edit" OR "Addon"
    OR "Update RESX files"
    OR "update_repository"
    OR "Mercurial")
| rex field=_raw "(?<suspect_filename>[\w\-/\.]*\.resx)"
| where match(suspect_filename, "^-|/-")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(suspect_filename) as filenames by user, src_ip, host
| where count >= 1
| sort - first_seen

Wazuh OSSEC Rule

<group name="weblate,cve-2026-86035,">
  <rule id="202686035" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">hg|mercurial</field>
    <regex field="process.args">(?i)-\S*\.resx</regex>
    <description>CVE-2026-86035: Suspicious Mercurial invocation with hyphen-prefixed argument while processing Weblate RESX component (possible argument injection / command execution)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>command_injection,</group>
  </rule>

  <rule id="202686036" level="10">
    <decoded_as>json</decoded_as>
    <field name="weblate.action">component.edit</field>
    <field name="weblate.filename">^-</field>
    <description>CVE-2026-86035: Weblate user with component.edit permission created a repository filename beginning with a hyphen (argument-injection staging)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is patched in Weblate 2026.8; no vendor advisory, commit reference, or diff was provided in the available data, so remediation should be validated against the vendor channel.

1. Immediate mitigations

   • Upgrade to Weblate 2026.8 or later as soon as releases are available for your deployment channel (the only remediation explicitly stated in the source data).
   • Restrict component.edit permission to fully trusted project maintainers; this permission is the documented prerequisite for exploitation.
   • Disable or remove the "Update RESX files" add-on from Mercurial-backed components until patched, where operationally feasible.
   • Run the Weblate service account with least privilege and no shell/environment secrets; constrain outbound network egress from the Weblate host.
   • Audit existing Mercurial repository filenames for entries beginning with - and remediate anomalous names.
   • Because this is a residual fix for CVE-2022-23915, do not assume prior CVE-2022-23915 remediation covers this issue.

2. Patch / upgrade steps

   • Track the upstream Weblate project for the 2026.8 release and its associated changelog and security advisory; verify CVE-2026-86035 is explicitly addressed.
   • Stage the upgrade in a test environment that includes a Mercurial-backed RESX component with the "Update RESX files" add-on to confirm remediation behavior.
   • After upgrade, re-verify service account permissions and review repository histories for tampering.

3. Long-term hardening

   • Sanitize and validate all repository path and filename input at the application boundary; use argument separators / ---style option terminators so leading-hyphen filenames are always treated as literal paths.
   • Adopt parameterized subprocess invocation (argument vectors rather than shell string construction) for all VCS backend calls.
   • Apply least-privilege and network-egress restrictions to the Weblate service account.
   • Add continuous monitoring for hyphen-prefixed repository filenames and unusual Mercurial subprocess activity.

References

• NVD — CVE-2026-86035: https://nvd.nist.gov/vuln/detail/CVE-2026-86035
• CVE.org record: https://www.cve.org/CVERecord?id=CVE-2026-86035
• CWE-78 — OS Command Injection: https://cwe.mitre.org/data/definitions/78.html
• Related prior CVE — CVE-2022-23915 (original issue; CVE-2026-86035 is a residual incomplete fix): https://nvd.nist.gov/vuln/detail/CVE-2022-23915
• Weblate project security advisories and release notes: https://weblate.org/ (verify the 2026.8 advisory)

No threat actor campaign, public proof-of-concept, exploit code, or in-the-wild exploitation evidence was available in the provided data. The CVE is not listed in CISA KEV.