weblateorg/weblate · Security
Weblate vulnerable to XSS via crafted Markdown
- GHSA ID
- GHSA-5cmv-3rc4-7279
- CVE ID
- CVE-2026-44264
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS v3
- 4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
Impact
The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.
Patches
Workarounds
Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.
Acknowlegement
Michal Čihař has identified and fixed this vulnerability.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5cmv-3rc4-7279 ↗
- https://github.com/WeblateOrg/weblate/pull/19259 ↗
- https://github.com/WeblateOrg/weblate/commit/85abc9df88b7464f4c0e794aef752e45f4230f75 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-44264 ↗
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 ↗
- https://github.com/advisories/GHSA-5cmv-3rc4-7279 ↗