CVE-2026-45106 MEDIUM

CVE-2026-45106: Weblate: Stored HTML injection in editor search preview

Vendor Weblateorg
Product weblate
Weakness CWE-79 · XSS
Published June 10, 2026
Last update June 11, 2026
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.

Key dates

02Disclosure timeline

June 10, 2026 CVE published
June 11, 2026 Record updated