CVE-2026-42150: wlc: print_html outputs API data without HTML escaping, enabling stored XSS
wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42150?
The severity of CVE-2026-42150 is considered high due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2026-42150?
To fix CVE-2026-42150, upgrade to Weblate wlc version 2.0.0 or later, which includes the necessary HTML escaping.
What does CVE-2026-42150 affect?
CVE-2026-42150 affects Weblate wlc versions prior to 2.0.0, using the Weblate REST API for HTML output.
What type of vulnerability is CVE-2026-42150?
CVE-2026-42150 is a stored cross-site scripting (XSS) vulnerability that occurs due to improper HTML escaping.
Who is affected by CVE-2026-42150?
Users and organizations utilizing Weblate wlc versions before 2.0.0 are at risk from CVE-2026-42150.