{"id":"CVE-2026-42150","aliases":["DEBIAN-CVE-2026-42150","EUVD-2026-28501","GHSA-gx2m-mcc2-r4p3","PYSEC-2026-2321","UBUNTU-CVE-2026-42150"],"status":"published","title":"wlc: print_html outputs API data without HTML escaping, enabling stored XSS","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","severity":{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00174,"percentile":0.06856,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-04-24T20:43:30Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"PyPI","package":"wlc","fixed_in":["2.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"wlc","fixed_in":["2.0.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-2","1.14-1","1.15-1","1.15-2","1.16.1-1","1.17.2-1","2.0.0-1","2.2.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-1","1.15-2","1.16.1-1","1.17.2-1","2.0.0-1","2.2.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}],"versions":["1.15-1","1.15-2","1.16.1-1","1.17.2-1"]},{"source":"osv","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}],"versions":["0.0","0.1","0.10","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16.1","1.17.0","1.17.1","1.17.2","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}],"versions":["0.0","0.1","0.10","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16.1","1.17.0","1.17.1","1.17.2","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8-1","0.8-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1-1","1.2-1","1.2-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-1","1.2-1ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-2","1.13-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-1","1.15-2","1.15-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","2.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-2","1.16.1-1"]}],"products":[{"vendor":"weblate","product":"wlc"},{"vendor":"weblateorg","product":"wlc"}],"references":[{"url":"https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/pull/1327","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/releases/tag/2.0.0","tags":["x_refsource_MISC","Release Notes","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42150","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gx2m-mcc2-r4p3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42150.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42150","tags":["advisory"]},{"url":"https://github.com/WeblateOrg/wlc","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-42150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42150","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42150","title":"wlc: print_html outputs API data without HTML escaping, enabling stored XSS","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T03:23:12.234Z","modified":"2026-05-08T21:28:38.342Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-28501","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T03:23:12Z","modified":"2026-05-08T21:28:38Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:05:14.089367Z"}],"ghsa":[{"id":"GHSA-gx2m-mcc2-r4p3","title":"wlc: print_html outputs API data without HTML escaping","description":"### Impact\nThe HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.\n\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1327\n\n### Workarounds\nThe only vulnerable code path is HTML output which is opt-in.\n\n### References\nWeblate thanks @fg0x0 for reporting this on GitHub.","status":"published","published":"2026-04-24T20:43:30Z","modified":"2026-05-12T13:27:33Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:05.816188Z"}],"nvd":[{"id":"CVE-2026-42150","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T04:16:18.92Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-42150","title":"wlc: print_html outputs API data without HTML escaping, enabling stored XSS","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T03:23:12.234Z","modified":"2026-10-28T02:30:23.531554689Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42150","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T04:16:18.92Z","modified":"2026-10-27T10:01:22.93912933Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-gx2m-mcc2-r4p3","title":"wlc: print_html outputs API data without HTML escaping","description":"### Impact\nThe HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.\n\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1327\n\n### Workarounds\nThe only vulnerable code path is HTML output which is opt-in.\n\n### References\nWeblate thanks @fg0x0 for reporting this on GitHub.","status":"published","published":"2026-04-24T20:43:30Z","modified":"2026-07-13T07:26:14.296094134Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"PYSEC-2026-2321","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T04:16:18.92Z","modified":"2026-07-13T07:15:48.786101852Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-42150","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.","status":"published","published":"2026-05-08T04:16:00Z","modified":"2026-10-17T12:58:54.335446164Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}