CVE-2026-45106: Weblate: Stored HTML injection in editor search preview

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-10-26
Weakness: CWE-79

Description

Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.

Affected products

WeblateOrg weblate: before 2026.5

References

https://github.com/WeblateOrg/weblate/pull/19422
https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m

Get alerted when CVE-2026-45106 or the next vulnerability affects your stack