CVE-2026-86035

Weblate versions 4.11.1 through 2026.7.1 are vulnerable to an argument-injection flaw in the Mercurial backend . The root cause is that repository filenames starting with a hyphen (-) may be misinterpreted as Mercurial options rather than literal paths. An authenticated user with component.edit p...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

EUVD-2026-88976

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035: Improper Neutralization of Special Elements used in an OS Command

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

PT-2026-102639

Name of the Vulnerable Software and Affected Versions Weblate versions 4.11.1 through 2026.7.1 Description An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen - may be interpreted as Mercurial...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57179 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57179 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57179 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57179 Source advisory: OSV:GHSA-VQG6-3FW6-J9JG...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57178 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57178 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57178 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57178 Source advisory: OSV:GHSA-3C93-F73F-QC9H...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57178 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57177 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57177 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57176 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57176 Source advisory: OSV:GHSA-FP7W-M676-W7GC...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57176 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57176 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57176 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57175 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57175 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57175 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57175 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...