---
id: CVE-2026-44264
aliases:
  - GHSA-5cmv-3rc4-7279
  - PYSEC-2026-2319
title: Weblate vulnerable to XSS via crafted Markdown
summary: Weblate vulnerable to XSS via crafted Markdown
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
vendor: weblate
product: weblate
ecosystem: pip
affected:
  - weblate < 5.17.1
patched:
  - weblate 5.17.1
published: '2026-05-07'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5cmv-3rc4-7279'
references:
  - url: >-
      https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5cmv-3rc4-7279
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44264'
  - url: 'https://github.com/WeblateOrg/weblate/pull/19259'
  - url: >-
      https://github.com/WeblateOrg/weblate/commit/85abc9df88b7464f4c0e794aef752e45f4230f75
  - url: 'https://github.com/WeblateOrg/weblate'
  - url: 'https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1'
tags:
  - osv
  - pip
epss: 0.00369
epssPercentile: 0.2797
ingestedAt: '2026-07-13T18:57:53.155Z'
---

## Overview

### Impact
The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.

### Patches
* https://github.com/WeblateOrg/weblate/pull/19259

### Workarounds
Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.

### Acknowlegement
Michal Čihař has identified and fixed this vulnerability.

## Affected packages

- `weblate < 5.17.1`

## Remediation

Upgrade to a patched release:

- `weblate 5.17.1`