Weblate: Stored HTML injection in editor search preview
### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. ### Patches * https://github.com/WeblateOrg/weblate/pull/19422 ### Workarounds Only the search preview on the selected views is affected. ### Resources Weblate thanks @adrgs for reporting this issue responsibly via GitHub.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-45106US | — | — | ||
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose con… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/WeblateOrg/weblatePACKAGE
- https://github.com/WeblateOrg/weblate/commit/8b0adf1d0b43dfc0d09da4b878857b2288b84f2dWEB
- https://github.com/WeblateOrg/weblate/pull/19422WEB
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5WEB
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26mWEB
- https://github.com/advisories/GHSA-6wxc-8mgq-w26mADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-45106ADVISORY
- https://pypi.org/project/weblatePACKAGE
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan