PT-2026-38401 · Pypi · Weblate

Published 2026-05-07 · Updated 2026-05-07 · CVE-2026-44264

OSV

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Impact

The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.

Patches

• https://github.com/WeblateOrg/weblate/pull/19259

Workarounds

Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.

Acknowlegement

Michal Čihař has identified and fixed this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-44264

GHSA-5CMV-3RC4-7279

Affected Products

Weblate

References · 5

• https://osv.dev/vulnerability/GHSA-5cmv-3rc4-7279 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/commit/85abc9df88b7464f4c0e794aef752e45f4230f75 · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5cmv-3rc4-7279 · Note
• https://github.com/WeblateOrg/weblate/pull/19259 · Note