Executive brief
Weblate is a web-based platform used by organizations to manage software translation and localization. A security flaw in the search preview feature allows a contributor to upload malicious content that executes in the browsers of other authenticated users. This could lead to unauthorized actions being performed on behalf of legitimate editors or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Weblate's live search preview feature. The application fails to properly escape unit source and context fields before rendering them as HTML in the editor interface. An attacker with contributor privileges can submit malicious HTML or CSS payloads that are stored in the database. When other authenticated users perform a search that matches the malicious entry, the payload executes in their browser context. This allows for potential session hijacking or unauthorized data modification. The issue is resolved in version 2026.5 by implementing proper output encoding.
Affected products
- WeblateOrg Weblate < 2026.5
Timeline
- 2026-05-07: other: Fix developed in pull request #19422
- 2026-05-15: patched: Version 2026.5 released
- 2026-06-10: disclosed: CVE-2026-45106 published