GHSA-5cmv-3rc4-7279MediumCVSS 4.3

Weblate vulnerable to XSS via crafted Markdown

Published
May 7, 2026
Last Modified
May 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-44264 →

📋 Description

Impact

The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.

Patches

  • https://github.com/WeblateOrg/weblate/pull/19259

Workarounds

Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.

Acknowlegement

Michal Čihař has identified and fixed this vulnerability.

🎯 Affected products1

  • pip/weblate:< 5.17.1

🔗 References (6)