{"id":"CVE-2026-45106","aliases":["GHSA-6wxc-8mgq-w26m","PYSEC-2026-3415"],"title":"Weblate: Stored HTML injection in editor search preview","summary":"Weblate: Stored HTML injection in editor search preview","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate < 2026.5"],"patched":["weblate 2026.5"],"published":"2026-05-15","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6wxc-8mgq-w26m","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45106"},{"url":"https://github.com/WeblateOrg/weblate/pull/19422"},{"url":"https://github.com/WeblateOrg/weblate/commit/8b0adf1d0b43dfc0d09da4b878857b2288b84f2d"},{"url":"https://github.com/WeblateOrg/weblate"},{"url":"https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5"}],"tags":["osv","pip"],"epss":0.00208,"epssPercentile":0.1123,"ingestedAt":"2026-07-13T18:57:54.058Z","slug":"CVE-2026-45106","body":"## Overview\n\n### Impact\nWeblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search.\n\n### Patches\n* https://github.com/WeblateOrg/weblate/pull/19422\n\n### Workarounds\nOnly the search preview on the selected views is affected.\n\n### Resources\nWeblate thanks @adrgs for reporting this issue responsibly via GitHub.\n\n## Affected packages\n\n- `weblate < 2026.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 2026.5`","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}