Vulnerability Description
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/WeblateOrg/weblate/pull/19422
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m
FAQ
What is CVE-2026-45106?
CVE-2026-45106 is a vulnerability with a CVSS score of 4.6 (MEDIUM). Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those f...
How severe is CVE-2026-45106?
CVE-2026-45106 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45106?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.