---
id: CVE-2026-45106
aliases:
  - GHSA-6wxc-8mgq-w26m
  - PYSEC-2026-3415
title: 'Weblate: Stored HTML injection in editor search preview'
summary: 'Weblate: Stored HTML injection in editor search preview'
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'
vendor: weblate
product: weblate
ecosystem: pip
affected:
  - weblate < 2026.5
patched:
  - weblate 2026.5
published: '2026-05-15'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6wxc-8mgq-w26m'
references:
  - url: >-
      https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45106'
  - url: 'https://github.com/WeblateOrg/weblate/pull/19422'
  - url: >-
      https://github.com/WeblateOrg/weblate/commit/8b0adf1d0b43dfc0d09da4b878857b2288b84f2d
  - url: 'https://github.com/WeblateOrg/weblate'
  - url: 'https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5'
tags:
  - osv
  - pip
epss: 0.00289
epssPercentile: 0.1913
ingestedAt: '2026-07-13T18:57:54.058Z'
---

## Overview

### Impact
Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search.

### Patches
* https://github.com/WeblateOrg/weblate/pull/19422

### Workarounds
Only the search preview on the selected views is affected.

### Resources
Weblate thanks @adrgs for reporting this issue responsibly via GitHub.

## Affected packages

- `weblate < 2026.5`

## Remediation

Upgrade to a patched release:

- `weblate 2026.5`