CVE-2026-45106
published 2026-06-10CVE-2026-45106: Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any…
PriorityP424medium4.6CVSS 3.1
AVNACLPRLUIRSUCLILAN
EPSS
0.21%
11.2th percentile
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| weblate | weblate | >= 0 < 2026.5 | 2026.5 |
| weblateorg | weblate | < 2026.5 | 2026.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
weblate up to 2026.4 cross site scripting (GHSA-6wxc-8mgq-w26m / EUVD-2026-36114)
vuldb·2026-06-10·CVSS 4.6
CVE-2026-45106 [MEDIUM] weblate up to 2026.4 cross site scripting (GHSA-6wxc-8mgq-w26m / EUVD-2026-36114)
A vulnerability labeled as problematic has been found in weblate up to 2026.4. Impacted is an unknown function. The manipulation results in cross site scripting.
This vulnerability is cataloged as CVE-2026-45106. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
Weblate: Stored HTML injection in editor search preview
ghsa·2026-05-15
CVE-2026-45106 [MEDIUM] CWE-79 Weblate: Stored HTML injection in editor search preview
Weblate: Stored HTML injection in editor search preview
### Impact
Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search.
### Patches
* https://github.com/WeblateOrg/weblate/pull/19422
### Workarounds
Only the search preview on the selected views is affected.
### Resources
Weblate thanks @adrgs for reporting this issue responsibly via GitHub.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-10
Published