CVE-2026-42150

Name	CVE-2026-42150
Description	wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1136000

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wlc (PTS)	bullseye	1.2-1	vulnerable
	bookworm	1.13-2	vulnerable
	trixie	1.15-1	vulnerable
	forky, sid	2.0.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
wlc	source	(unstable)	2.0.0-1			1136000

Notes

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3
https://github.com/WeblateOrg/wlc/pull/1327
https://github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469 (2.0.0)