Medium severity · published Jun 10, 2026
CVE-2026-45106
Weblate: Stored HTML injection in editor search preview
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
weblate · WeblateOrg
< 2026.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45106
github.com
https://github.com/WeblateOrg/weblate/pull/19422
github.com
https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5
github.com
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m
More from weblate
9.8
CVE-2025-64725
Weblate has improper validation upon invitation acceptance
9.1
CVE-2026-24126
Weblate has an argument injection in management console
9.1
CVE-2025-68398
Weblate has git config file overwrite vulnerability that leads to remote code execution
8.8
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
8.5
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution