CVE-2026-45106: Weblate Stored HTML Injection in Editor Search Preview
Summary
CVE-2026-45106: Weblate: Stored HTML injection in editor search preview. Affects weblate versions < 2026.5. Fixed in 2026.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is a web-based translation management system that facilitates collaborative translation processes. It allows users to manage translation projects, collaborate on translations, and integrate with various version control systems. The platform is designed to streamline the translation workflow, making it easier for contributors to work together. However, a vulnerability has been identified that affects the security of the live search preview feature in the editor.
Vulnerability Detail
The vulnerability arises from Weblate's live search preview rendering unit 'source' and 'context' as HTML without proper escaping. This flaw allows any contributor who inputs content into these fields to store malicious HTML and CSS. When other users perform a matching search, this injected code executes within their authenticated editor environment, potentially leading to unauthorized actions or data exposure.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.5
This is the first release that contains the fix.
pip install --upgrade "weblate==2026.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the search preview feature in the affected views until the patch is applied. This will mitigate the risk of executing malicious code while searching.
Conclusion
In summary, CVE-2026-45106 highlights a significant security vulnerability in Weblate that can lead to stored HTML injection through the editor's live search preview. Users are encouraged to update to the latest version to mitigate risks and ensure a secure translation management environment.
See every vulnerability recorded for weblate →
FAQ
The vulnerability is a stored HTML injection that allows malicious code to be executed in the editor's live search preview.
Any user who has access to the Weblate editor and performs searches that match the injected content is at risk.
The consequences include unauthorized actions within the editor, potential data exposure, and a compromised user experience.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 4.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
