CVE-2026-42150

MediumCVSS 5.1

Published: 08/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

wlc, a Weblate command-line client using the Weblate REST API, prior to version 2.0.0 embeds API response data into HTML without escaping. This allows cross-site scripting when the output is rendered in a browser.

Risk Assessment

A user viewing the generated HTML output in a browser may be exposed to malicious script execution. This could lead to session theft or actions performed in the user's browser context.

Recommendation

Update wlc to version 2.0.0 or later, which patches this vulnerability.

Other vulnerabilities in wlc

CVE-2026-62364Low
wlc is a Weblate command-line client. Prior to 2.0.1, automatically discovered configuration can select the API URL while an unscoped API token is supplied without a matching URL. When wlc runs in an untrusted repository, it can send the token to an attacker-controlled URL. URL-scoped keys are not affected. Fixed in version 2.0.1.

Original NVD description (English source)

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS