GitHub Advisoryadvisory · PyPI

GHSA-gx2m-mcc2-r4p3 wlc: print_html outputs API data without HTML escaping

MEDIUM Published 2026-04-24 Modified 2026-05-12 Official page ↗
Aliases
CVE-2026-42150
Ecosystem
PyPI
Packages
wlc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2026-04-24

Affected packages

• PyPI wlc: < 2.0.0 → fixed in 2.0.0

Description

Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. Patches • https://github.com/WeblateOrg/wlc/pull/1327 Workarounds The only vulnerable code path is HTML output which is opt-in. References Weblate thanks @fg0x0 for reporting this on GitHub.

Related

Alias · CVE (1)

  • CVE-2026-42150 wlc is a Weblate command-line client using Weblate's REST API. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References