AIKIDO-2026-497368
weblate is vulnerable to Argument Injection
85
High Risk
This Affects:
weblateTL;DR
Weblate's Mercurial backend passes repository filenames to hg commands without an option terminator, so filenames beginning with a dash are interpreted as Mercurial options rather than paths. An authenticated user with project-scoped component edit permission can exploit this using the Update RESX files add-on. A later repository update can then execute arbitrary commands with the privileges of the Weblate service account. The fix places filenames after an explicit option terminator so option-shaped names are treated as literal paths.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use Mercurial-backed components with the Update RESX files add-on and grant component edit permission to untrusted users.
Background info
weblate is vulnerable to Argument Injection in versions 4.11.1 - 2026.7.1.
How to fix this
Upgrade the weblate library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant