CVE-2026-42150

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.

CVSS v3 5.1 MEDIUM

5.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469	Patch
https://github.com/WeblateOrg/wlc/pull/1327	Issue Tracking Patch
https://github.com/WeblateOrg/wlc/releases/tag/2.0.0	Release Notes
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) wlc es un cliente de línea de comandos de Weblate que utiliza la API REST de Weblate. Antes de la versión 2.0.0, el formato de salida HTML en wlc incrusta datos de respuesta de la API en HTML sin escapar, permitiendo cross-site scripting cuando la salida se renderiza en un navegador. Este problema ha sido parcheado en la versión 2.0.0.

Information

Published : 2026-05-08 04:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-42150

Mitre link : CVE-2026-42150

CVE.ORG link : CVE-2026-42150

JSON object : View

Products Affected

weblate

wlc

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-42150", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42150", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:32:14.516536Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"status": "affected", "version": "< 2.0.0"}]}]}], "published": "2026-05-08T04:16:18.920", "references": [{"url": "https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/pull/1327", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0."}, {"lang": "es", "value": "wlc es un cliente de l\u00ednea de comandos de Weblate que utiliza la API REST de Weblate. Antes de la versi\u00f3n 2.0.0, el formato de salida HTML en wlc incrusta datos de respuesta de la API en HTML sin escapar, permitiendo cross-site scripting cuando la salida se renderiza en un navegador. Este problema ha sido parcheado en la versi\u00f3n 2.0.0."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD614A09-5564-4D12-982B-D4953DEC0DC6", "versionEndExcluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}