Weblate: Stored HTML injection in editor search preview
Date: 2026-05
Affected: pip/weblate
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-45106
CWE: CWE-79
CVSS: 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. ### Patches * https://github.com/WeblateOrg/weblate/pull/19422 ### Workarounds Only the search preview on the selected views is affected. ### Resources Weblate thanks @adrgs for reporting this issue responsibly via GitHub.


Mitigations:

Architectural layers (MAESTRO):