Description
wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
Affected products
weblate: wlc
References4
- github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4… Vendor Advisory
- github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a17… Patch
- github.com/WeblateOrg/wlc/pull/1327 Issue TrackingPatch
- github.com/WeblateOrg/wlc/releases/tag/2.0.0 Release Notes
Metrics
- CVSS 3.1
-
4.8
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 7 · as of 13 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.