wlc: print_html outputs API data without HTML escaping
Date: 2026-04
Affected: pip/wlc
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-42150
CWE: CWE-79
CVSS: 5.1 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L)

### Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. ### Patches * https://github.com/WeblateOrg/wlc/pull/1327 ### Workarounds The only vulnerable code path is HTML output which is opt-in. ### References Weblate thanks @fg0x0 for reporting this on GitHub.


Mitigations:

Architectural layers (MAESTRO):