CVE-2026-44264
Stored XSS in Weblate via Markdown Renderer
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| weblate | weblate | to 5.17.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability CVE-2026-44264 is a Cross-Site Scripting (XSS) issue in Weblate's Markdown renderer that could allow injection of malicious scripts in user-provided content.
While the vulnerability itself does not directly mention impacts on compliance with standards such as GDPR or HIPAA, XSS vulnerabilities can potentially lead to unauthorized access or manipulation of user data, which may affect data protection and privacy requirements under these regulations.
Weblate mitigates some risk through a strict Content Security Policy (CSP), and the issue has been fixed in version 5.17.1, reducing the likelihood of exploitation.
However, since the vulnerability involves improper sanitization of user input, organizations using affected versions should consider the risk of data integrity and confidentiality breaches that could impact compliance with data protection standards.
Can you explain this vulnerability to me?
CVE-2026-44264 is a Cross-Site Scripting (XSS) vulnerability in Weblate, a web-based localization tool. The issue exists in the Markdown renderer used for user comments and other user-provided content, where certain attributes were not properly sanitized. This flaw allows an attacker to inject malicious scripts into HTML content.
The vulnerability affects versions of Weblate prior to 5.17.1, which includes the patch that fixes this issue by properly escaping image target URLs and other attributes before rendering.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with low privileges to inject malicious scripts into user comments or other user-provided content in Weblate. Such scripts could execute in the context of other users viewing the content, potentially leading to unauthorized actions or data manipulation.
However, the impact is somewhat mitigated by Weblate's strict Content Security Policy (CSP), which reduces the risk of successful exploitation.
The CVSS score of 4.3 indicates a moderate severity with low attack complexity and no user interaction required.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Cross-Site Scripting (XSS) issue in the Markdown renderer of Weblate versions prior to 5.17.1, affecting user comments and other user-provided content. Detection would involve identifying if your Weblate instance is running a vulnerable version and if user inputs are being rendered without proper sanitization.
Since the vulnerability relates to improper sanitization of Markdown-rendered content, detection on the network or system level would typically require checking the Weblate version and reviewing user-generated content for suspicious scripts or attributes.
There are no specific commands provided in the available resources to detect this vulnerability directly on your system or network.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Weblate to version 5.17.1 or later, where the vulnerability has been patched by properly escaping image target URLs and other user-provided content in the Markdown renderer.
Additionally, Weblate employs a strict Content Security Policy (CSP) which helps mitigate the risk of exploitation by restricting the execution of injected scripts.
Review and apply the patch that ensures proper escaping of URLs and attributes in markdown content, as implemented in the `weblate/utils/markdown.py` file.