CVE-2026-42150: weblate wlc

csirt@kutim:~/threat-intel/cve/CVE-2026-42150

CVSS 4.8 · Medium EPSS 0,30%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada weblate wlc. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.

Rincian

Terbit di NVD: 8 Mei 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 21,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
weblate	wlc	Semua versi sebelum 2.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3 advisory vendor
https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469 patch
https://github.com/WeblateOrg/wlc/pull/1327 issue tracking · patch
https://github.com/WeblateOrg/wlc/releases/tag/2.0.0 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.