# CVE-2026-45106: Weblate stored XSS in live search preview

Source: https://junglewise.ai/threats/cve-2026-45106-weblate-stored-xss-in-live-search-preview  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45106 · Severity: medium · CVSS 4.6 · Published 2026-06-10

Weblate is a web-based platform used by organizations to manage software translation and localization. A security flaw in the search preview feature allows a contributor to upload malicious content that executes in the browsers of other authenticated users. This could lead to unauthorized actions being performed on behalf of legitimate editors or the theft of sensitive session information.

Technologies: [weblate (PyPI)](https://junglewise.ai/threats/technologies/weblate). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-45106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45106 being exploited in the wild.

**How severe is CVE-2026-45106?** Medium severity, with a CVSS score of 4.6, published 10 June 2026.

**Which products and versions are affected?** weblate (PyPI) < 2026.5, ECOSYSTEM:introduced=0,fixed=2026.5.

**Is there a fix for CVE-2026-45106?** Yes. weblate (PyPI): upgrade to 2026.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45106 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45106?** Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- weblate (PyPI): upgrade to 2026.5 or later

  ```sh
  pip install "weblate>=2026.5"
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Weblate's live search preview feature. The application fails to properly escape unit source and context fields before rendering them as HTML in the editor interface. An attacker with contributor privileges can submit malicious HTML or CSS payloads that are stored in the database. When other authenticated users perform a search that matches the malicious entry, the payload executes in their browser context. This allows for potential session hijacking or unauthorized data modification. The issue is resolved in version 2026.5 by implementing proper output encoding.

## Affected products

- WeblateOrg Weblate < 2026.5

## Identifiers

- CVE-2026-45106
- GHSA-6wxc-8mgq-w26m
- PYSEC-2026-3415

## Timeline

- 2026-05-07: other: Fix developed in pull request #19422
- 2026-05-15: patched: Version 2026.5 released
- 2026-06-10: disclosed: CVE-2026-45106 published

## References

- [https://github.com/WeblateOrg/weblate/pull/19422](https://github.com/WeblateOrg/weblate/pull/19422)
- [https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5](https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.5)
- [https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m](https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6wxc-8mgq-w26m)

## Related threats

- [Weblate IDOR in GroupViewSet authorization bypass](https://junglewise.ai/threats/cve-2026-55228-weblate-idor-in-groupviewset-authorization-bypass)
- [Weblate observable object existence disclosure via HTTP status codes](https://junglewise.ai/threats/cve-2026-55227-weblate-observable-object-existence-disclosure-via-http-status)
- [PYSEC-2026-2037 - Weblate leaks information via screenshots](https://junglewise.ai/threats/cve-2026-21889-weblate-information-disclosure-via-unprotected-screenshots)
- [PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic links](https://junglewise.ai/threats/cve-2025-68279-weblate-has-an-arbitrary-file-read-via-symbolic-links)
- [PYSEC-2026-2036 - Weblate has a long session expiry when verifying second factor](https://junglewise.ai/threats/cve-2025-58352-weblate-weak-session-expiry-during-second-factor-verification)