CVE-2026-42150

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42150", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-24T17:15:21.835Z", "datePublished": "2026-05-08T03:23:12.234Z", "dateUpdated": "2026-05-08T21:28:38.342Z"}, "containers": {"cna": {"title": "wlc: print_html outputs API data without HTML escaping, enabling stored XSS", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3"}, {"name": "https://github.com/WeblateOrg/wlc/pull/1327", "tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/wlc/pull/1327"}, {"name": "https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469", "tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469"}, {"name": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.0"}], "affected": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"version": "< 2.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T03:23:12.234Z"}, "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0."}], "source": {"advisory": "GHSA-gx2m-mcc2-r4p3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T14:32:14.516536Z", "id": "CVE-2026-42150", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T21:28:38.342Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42150", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T14:32:14.516536Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T14:33:23.956Z"}}], "cna": {"title": "wlc: print_html outputs API data without HTML escaping, enabling stored XSS", "source": {"advisory": "GHSA-gx2m-mcc2-r4p3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"status": "affected", "version": "< 2.0.0"}]}], "references": [{"url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3", "name": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WeblateOrg/wlc/pull/1327", "name": "https://github.com/WeblateOrg/wlc/pull/1327", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469", "name": "https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.0", "name": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T03:23:12.234Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42150", "state": "PUBLISHED", "dateUpdated": "2026-05-08T21:28:38.342Z", "dateReserved": "2026-04-24T17:15:21.835Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T03:23:12.234Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wlc", "vendor": "WeblateOrg", "versions": [{"status": "affected", "version": "< 2.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD614A09-5564-4D12-982B-D4953DEC0DC6", "versionEndExcluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0."}, {"lang": "es", "value": "wlc es un cliente de l\u00ednea de comandos de Weblate que utiliza la API REST de Weblate. Antes de la versi\u00f3n 2.0.0, el formato de salida HTML en wlc incrusta datos de respuesta de la API en HTML sin escapar, permitiendo cross-site scripting cuando la salida se renderiza en un navegador. Este problema ha sido parcheado en la versi\u00f3n 2.0.0."}], "id": "CVE-2026-42150", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42150", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T14:32:14.516536Z", "version": "2.0.3"}}]}, "published": "2026-05-08T04:16:18.920", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/WeblateOrg/wlc/pull/1327"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/WeblateOrg/wlc/releases/tag/2.0.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wlc", "source": "cna", "vendor": "WeblateOrg"}, "product": "wlc", "vendor": "weblateorg"}], "created": "2026-05-08T06:00:11.355193+00:00", "updated": "2026-05-08T07:00:03.393687+00:00", "vendors": ["weblateorg", "weblateorg$PRODUCT$wlc"]}