GHSA-6wxc-8mgq-w26m

Weblate: Stored HTML injection in editor search preview

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-45106

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	weblate	< 2026.5	2026.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. ### Patches * https://github.com/WeblateOrg/weblate/pull/19422 ### Workarounds Only the search preview on the selected views is affected. ### Resources Weblate thanks @adrgs for reporting this issue responsibly via GitHub.

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m web
https://nvd.nist.gov/vuln/detail/CVE-2026-45106 advisory
https://github.com/WeblateOrg/weblate/pull/19422 web
https://github.com/WeblateOrg/weblate/commit/8b0adf1d0b43dfc0d09da4b878857b2288b84f2d web
https://github.com/WeblateOrg/weblate package
https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5 web