Summary
Weblate contains an argument-injection vulnerability in its Mercurial backend when repository filenames beginning with a hyphen are processed as command-line options rather than literal paths. An authenticated user with project-scoped component.edit permission may influence a Mercurial-backed RESX component and, after a later repository update, potentially execute arbitrary commands with the privileges of the Weblate service account.
Affected context
The issue occurs in Weblate deployments that use:
- A Mercurial-backed repository
- A RESX component
- The Update RESX files add-on
- Repository filenames that can begin with
-
Exploitation depends on an authenticated user having project-scoped component.edit permission and on a subsequent repository update processing the affected filename.
Exploit preconditions
- Attack surface: Weblate component and Mercurial repository integration
- Required access: Authenticated project-scoped
component.editpermission - Trigger point: A later repository update that invokes Mercurial operations on repository filenames
- Why exploitation is possible: Filenames beginning with a hyphen may be interpreted as Mercurial options, allowing attacker-controlled filename data to alter command behavior
Why this happens
The vulnerability results from insufficient separation between user-controlled filenames and command-line arguments passed to the Mercurial backend. When a filename beginning with - is forwarded without reliable argument delimiting or validation, the command-line parser may treat it as an option instead of a literal path.
This maps primarily to CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The resulting argument manipulation can overlap with CWE-78 when altered command behavior enables execution of operating-system commands.
Potential impact
- An attacker may execute arbitrary commands as the Weblate service account
- The Weblate application and its managed translation data could be compromised
- Repository contents or localization files could be modified or poisoned
- Credentials and other data accessible to the service account could be exposed
- The compromised service account could enable further lateral movement, depending on deployment permissions
General mitigation guidance
Mitigation generally focuses on treating repository filenames as untrusted data and preventing them from being interpreted as command options.
Common defensive patterns include:
- Passing subprocess arguments as a structured argument list rather than through shell command construction
- Using reliable end-of-options delimiters where supported by the invoked tool
- Rejecting or safely normalizing unexpected option-like filenames when the workflow does not require them
- Separating trusted command arguments from repository-derived paths
- Limiting the Weblate service account to the minimum filesystem, repository, and network privileges
- Applying process and container isolation to reduce the consequences of command execution
- Preserving validation and authorization checks across both component changes and subsequent repository updates
How teams detect issues like this
Detection can include:
- Static analysis for subprocess calls that concatenate or interpolate repository paths into command arguments
- Code review checks for missing end-of-options delimiters and unvalidated arguments beginning with
- - Tests using filenames that resemble command-line options across all repository integration workflows
- Policy enforcement requiring structured process APIs and prohibiting shell execution for repository-derived values
- Runtime monitoring for unexpected Mercurial options, child processes, file changes, or network activity from the Weblate service account
- Automated code review tools that flag argument construction and command-execution patterns
