id: PYSEC-2026-2321
published: "2026-05-08T04:16:18.920Z"
modified: "2026-07-13T05:52:36.964517Z"
aliases:
- CVE-2026-42150
- GHSA-gx2m-mcc2-r4p3
details: wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
affected:
- package:
    name: wlc
    ecosystem: PyPI
    purl: pkg:pypi/wlc
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.0.0
  versions:
  - "0.0"
  - "0.1"
  - "0.10"
  - "0.2"
  - "0.3"
  - "0.4"
  - "0.5"
  - "0.6"
  - "0.7"
  - "0.8"
  - "0.9"
  - "1.0"
  - "1.1"
  - "1.10"
  - "1.11"
  - "1.12"
  - "1.13"
  - "1.14"
  - "1.15"
  - 1.16.1
  - 1.17.0
  - 1.17.1
  - 1.17.2
  - "1.2"
  - "1.3"
  - "1.4"
  - "1.5"
  - "1.6"
  - "1.7"
  - "1.8"
  - "1.9"
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/WeblateOrg/wlc/releases/tag/2.0.0
- type: ADVISORY
  url: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3
- type: FIX
  url: https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469
- type: FIX
  url: https://github.com/WeblateOrg/wlc/pull/1327
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N