CVE-2022-24710: Cross-site Scripting in Weblate
Summary
CVE-2022-24710: Cross-site Scripting in Weblate. Affects weblate versions < 4.11. Fixed in 4.11. How to fix ↓
Also tracked for
- weblate · Bitnami
The same CVE-2022-24710 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation management system. It provides a platform for collaborative translation of software, documentation, and other types of content. Weblate allows users to contribute translations and manage localization projects. However, a vulnerability has been discovered in Weblate that allows for cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in Weblate is due to improper neutralization, which allows an attacker to perform cross-site scripting attacks by crafting malicious user and language names. This can lead to the execution of arbitrary JavaScript code in the context of a victim's browser. The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the victim.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.11
This is the first release that contains the fix.
pip install --upgrade "weblate==4.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update Weblate, you can mitigate the risk by checking for crafted user and language names in your installation. By identifying and removing any suspicious names, you can reduce the likelihood of exploitation.
Conclusion
The vulnerability in Weblate allows for cross-site scripting attacks, which can have serious consequences for users. It is crucial to update Weblate to the latest version and apply the provided patches to ensure the security of your installation. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for weblate →
FAQ
Weblate is an open-source web-based translation management system used for collaborative translation of software, documentation, and other content.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability allows for cross-site scripting attacks, which can lead to the execution of arbitrary JavaScript code in the victim's browser. This can result in the theft of sensitive information or unauthorized actions on behalf of the victim.
To fix this vulnerability, update Weblate to version 4.11 or later. Make sure to apply the provided patches.
If you are unable to immediately update Weblate, you can mitigate the risk by checking for crafted user and language names in your installation and removing any suspicious names.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
