Weblate is vulnerable to argument injection in its Mercurial backend because repository filenames that start with a hyphen are treated as Mercurial options instead of literal file paths. An authenticated user who has project‑scoped component.edit rights can exploit this flaw through the Update RESX files add‑on on a Mercurial‑backed RESX component. The flaw allows the attacker to inject arbitrary command‑line arguments that are executed with the privileges of the Weblate service account, leading to full remote code execution. This represents a significant breach of confidentiality, integrity, and availability for the system.

The vulnerability affects Weblate versions 4.11.1 through 2026.7.1. The affected product is the Weblate web‑based continuous localization platform by WeblateOrg. The issue is resolved in release 2026.8.

The CVSS score for this flaw is 8.5, indicating a high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with component.edit permission and the ability to trigger a repository update via the Update RESX files add‑on. Once triggered, the attacker can run arbitrary commands that inherit the privileges of the Weblate service process. This gives the attacker the full capability to compromise the host environment or further pivot within the network.