---
id: CVE-2026-62364
title: wlc is a Weblate command-line client using Weblate's REST API
summary: >-
  wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1,
  automatically discovered configuration from .weblate, .weblate.ini, or
  weblate.ini can select the API URL while an unscoped API token is supplied
  through WLC_…
severity: low
cvss: 2.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-349
vendor: wlc
product: wlc
affected:
  - wlc < 2.0.1
patched:
  - wlc 2.0.1
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62364'
references:
  - url: >-
      https://github.com/WeblateOrg/wlc/commit/15cbdfc5b2c6183ef6864ea758091643a0ce6c89
    label: security-advisories@github.com
  - url: 'https://github.com/WeblateOrg/wlc/pull/1500'
    label: security-advisories@github.com
  - url: 'https://github.com/WeblateOrg/wlc/releases/tag/2.0.1'
    label: security-advisories@github.com
  - url: 'https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-3mqq-hv9c-85hc'
  - url: 'https://github.com/WeblateOrg/wlc'
tags:
  - nvd
  - ghsa
  - pip
  - cve.org
  - osv
epss: 0.00098
epssPercentile: 0.00878
aliases:
  - GHSA-3mqq-hv9c-85hc
ecosystem: pip
ingestedAt: '2026-09-22T21:11:40.321Z'
---

## Overview

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-62364)

Affected packages:

- `wlc < 2.0.1`

Patched in:

- `wlc 2.0.1`

Source: https://github.com/advisories/GHSA-3mqq-hv9c-85hc