GitHub Advisoryadvisory · PyPI

GHSA-6wxc-8mgq-w26m Weblate: Stored HTML injection in editor search preview

MEDIUM Published 2026-05-15 Modified 2026-06-11 Official page ↗
Aliases
CVE-2026-45106
Ecosystem
PyPI
Packages
weblate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-05-15

Affected packages

• PyPI weblate: < 2026.5 → fixed in 2026.5

Description

Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. Patches • https://github.com/WeblateOrg/weblate/pull/19422 Workarounds Only the search preview on the selected views is affected. Resources Weblate thanks @adrgs for reporting this issue responsibly via GitHub.

Related

Alias · CVE (1)

  • CVE-2026-45106 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References