CVE-2026-44264: Weblate is vulnerable to XSS via crafted Markdown
Impact The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.
Patches https://github.com/WeblateOrg/weblate/pull/19259
Workarounds Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.
Acknowlegement Michal Čihař has identified and fixed this vulnerability.
Other sources
Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44264?
CVE-2026-44264 has a moderate severity due to insufficient sanitization of user-provided content.
How do I fix CVE-2026-44264?
To fix CVE-2026-44264, upgrade to Weblate version 5.17.1 or later.
What causes the vulnerability CVE-2026-44264?
CVE-2026-44264 is caused by the Markdown renderer's improper sanitization of certain HTML attributes.
Which versions of Weblate are affected by CVE-2026-44264?
Versions of Weblate prior to 5.17.1 are affected by CVE-2026-44264.
What is the potential impact of CVE-2026-44264?
The potential impact of CVE-2026-44264 includes the ability for an attacker to inject malicious code into user-generated content.