🎯 New Report #3874004: Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get file() leads to command execution
🔺Severity: High
👽 Reporter: mask0ff
⭐️ Reputation: 178
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-19
⏰ Disclosed: 2026-09-15 08:36:07
📝 Summary: A vulnerability was discovered in Weblate, a web-based translation tool. The vulnerability was caused by an incomplete fix for a previous issue (CVE-2022-23915). Weblate passed repository-controlled filenames to Mercurial without properly escaping them, allowing filenames beginning with "-" to be interpreted as command-line options. This could be abused by an authenticated user with project-scoped component-edit permission to inject Mercurial configuration and execute arbitrary commands as the Weblate service account. The vulnerability affected Weblate versions 4.11.1 through 2026.7.1 and was later assigned CVE-2026-86035.
📂 Report JSON File: 3874004
@hackeronereports