CVE-2026-42150 wlc: print_html outputs API data without HTML escaping, enabling stored XSS
The wlc CLI tool fails to escape HTML in its output, allowing attackers to inject scripts that execute when the output is viewed in a browser.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42150?
CVE-2026-42150 is a medium-severity cross-site scripting vulnerability in WeblateOrg wlc, published on 8 May 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-42150?
3 open source packages ship an affected version, including wlc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wlc PyPI | All versions | 2.0.0 |
wlc PyPI | All versions | 2.0.0 |
wlc PyPI | All versions | 2.0.0 |
Products include Weblate Wlc.
How do I fix CVE-2026-42150?
Upgrade wlc to 2.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42150 being exploited?
There is no known exploitation of CVE-2026-42150 in the wild and no public exploit code.
Other vulnerabilities in WeblateOrg wlc
Sources
Also known as DEBIAN-CVE-2026-42150, GHSA-gx2m-mcc2-r4p3, PYSEC-2026-2321, UBUNTU-CVE-2026-42150.