GHSA-gx2m-mcc2-r4p3

wlc: print_html outputs API data without HTML escaping

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-42150

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	wlc	< 2.0.0	2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. ### Patches * https://github.com/WeblateOrg/wlc/pull/1327 ### Workarounds The only vulnerable code path is HTML output which is opt-in. ### References Weblate thanks @fg0x0 for reporting this on GitHub.

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3 web
https://nvd.nist.gov/vuln/detail/CVE-2026-42150 advisory
https://github.com/WeblateOrg/wlc/pull/1327 web
https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469 web
https://github.com/WeblateOrg/wlc package
https://github.com/WeblateOrg/wlc/releases/tag/2.0.0 web