Listen to this Post
The vulnerability resides in Weblate’s live search preview feature.
This feature is used when editing translations to dynamically display search results.
The preview renders the `source` and `context` fields of translation units as raw HTML.
No HTML escaping or sanitization is applied to these fields before rendering.
An attacker with contributor privileges can inject malicious HTML or CSS into these fields.
The injected content is stored persistently in the Weblate database.
When another user performs a search that matches the injected content, the browser renders the malicious HTML.
The payload executes within the authenticated editor session of the victim user.
This allows the attacker to steal session cookies, perform actions on behalf of the victim, or deface the interface.
The vulnerable code was located in the client-side JavaScript that constructs the search preview.
Specifically, the code used jQuery to create HTML elements without proper encoding.
The fix, implemented in PR 19422, introduces URL sanitization and replaces unsafe jQuery methods with safer DOM APIs.
The vulnerability affects all Weblate versions prior to 2026.5.
The patch is included in version 2026.5, released on May 15, 2026.
dailycve form:
Platform: Weblate
Version: prior 2026.5
Vulnerability: stored HTML injection
Severity: moderate
date: May 15 2026
Prediction: patch: May 15
Analytics
What Undercode Say:
Check Weblate version
weblate --version
Alternative via pip
pip show weblate | grep Version
Test payload (safe example)
curl -X POST https://weblate.example.com/api/units/ -d '{"source":"<img src=x onerror=alert(1)>"}' -H "Authorization: Token $TOKEN"
Exploit:
- Attacker with contributor role adds a translation unit containing HTML payload in the source field.
2. Payload is stored in the database.
- Victim user performs a search that matches the malicious unit.
- Search preview renders the payload in victim’s browser.
- Payload executes, stealing session or performing unauthorized actions.
Protection:
- Upgrade to Weblate version 2026.5 or later.
- Apply the patch from PR 19422.
- Restrict contributor permissions.
- Implement Content Security Policy (CSP) headers.
- Use input validation and output encoding.
Impact:
- Session hijacking.
- Data theft.
- Account takeover.
- Defacement.
- Persistent compromise across all users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
