Executive brief
wlc is a command-line tool used to interact with the Weblate translation platform. A security flaw in versions prior to 2.0.0 allows malicious data from the Weblate API to be converted into web-ready HTML without proper safety checks. If a user generates an HTML report and views it in a web browser, an attacker could execute malicious scripts, potentially leading to unauthorized actions or data theft within that browser session.
Technical details
The wlc command-line client (prior to version 2.0.0) contains a stored cross-site scripting (XSS) vulnerability in its HTML output module. The `print_html` function embeds data retrieved from the Weblate REST API directly into HTML tags (such as <th> and <td>) without performing proper character escaping. An attacker with high privileges on a Weblate instance could inject malicious scripts into translation strings or metadata. When a user runs wlc with the `--format=html` flag and opens the resulting file in a browser, the script executes in the context of the local file or the domain hosting the report. This issue is addressed in version 2.0.0 by implementing a `format_html_value` helper to sanitize output.
Affected products
- WeblateOrg wlc < 2.0.0
Timeline
- 2026-04-20: patched: Fix merged into main branch via PR #1327
- 2026-04-21: advisory: Vendor security advisory GHSA-gx2m-mcc2-r4p3 published
- 2026-05-08: disclosed: CVE-2026-42150 published to NVD