Описание
Weblate vulnerable to XSS via crafted Markdown
Impact
The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.
Patches
Workarounds
Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.
Acknowlegement
Michal Čihař has identified and fixed this vulnerability.
Ссылки
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5cmv-3rc4-7279
- https://nvd.nist.gov/vuln/detail/CVE-2026-44264
- https://github.com/WeblateOrg/weblate/pull/19259
- https://github.com/WeblateOrg/weblate/commit/85abc9df88b7464f4c0e794aef752e45f4230f75
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
Пакеты
Наименование
weblate
pip
Затронутые версииВерсия исправления
< 5.17.1
5.17.1
Связанные уязвимости
CVSS3: 4.3
nvd
3 месяца назад
Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.
CVSS3: 4.3
debian
3 месяца назад
Weblate is a web based localization tool. Prior to version 5.17.1, the ...