GitHub Advisoryadvisory · PyPI

GHSA-5cmv-3rc4-7279 Weblate vulnerable to XSS via crafted Markdown

MEDIUM Published 2026-05-07 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-44264
Ecosystem
PyPI
Packages
weblate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2026-05-07

Affected packages

• PyPI weblate: < 5.17.1 → fixed in 5.17.1

Description

Impact The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. Patches • https://github.com/WeblateOrg/weblate/pull/19259 Workarounds Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks. Acknowlegement Michal Čihař has identified and fixed this vulnerability.

Related

Alias · CVE (1)

  • CVE-2026-44264 Weblate is a web based localization tool. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References