Staging Environment: Content and features may be unstable or change without notice.

Advisory Severity Curation

GHSA-gx2m-mcc2-r4p3

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-gx2m-mcc2-r4p3

wlc: print_html outputs API data without HTML escaping ### Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. ### Patches * https://github.com/WeblateOrg/wlc/pull/1327 ### Workarounds The only vulnerable code path is HTML output which is opt-in. ### References Weblate thanks @fg0x0 for reporting this on GitHub.

gitlab/pypi/wlc/CVE-2026-42150

wlc: print_html outputs API data without HTML escaping The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.

pypa/wlc/PYSEC-2026-2321

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.

pysec/PYSEC-2026-2321

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.