Weblate: Stored HTML injection in editor search preview
### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. ### Patches * https://github.com/WeblateOrg/weblate/pull/19422 ### Workarounds Only the search preview on the selected views is affected. ### Resources Weblate thanks @adrgs for reporting this issue responsibly via GitHub.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-45106US | — | — | ||
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose con… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/WeblateOrg/weblatePACKAGE
- https://github.com/WeblateOrg/weblate/commit/8b0adf1d0b43dfc0d09da4b878857b2288b84f2dWEB
- https://github.com/WeblateOrg/weblate/pull/19422WEB
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5WEB
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26mWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-45106ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan