Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-6wxc-8mgq-w26m, is a stored Cross-Site Scripting (XSS) issue in Weblate's editor. The root cause is the improper handling of user-controllable data when rendering live previews for search results and machine translation suggestions. The analysis of the patch commit 8b0adf1d0b43dfc0d09da4b878857b2288b84f2d reveals two primary vulnerable areas.
First, in weblate/static/editor/tools/search.js, the showResults function was constructing HTML for search previews by directly concatenating source and context data from search results into an HTML string. This allowed malicious actors to inject arbitrary HTML and scripts into these fields, which would then be executed in the browsers of users who viewed the search preview.
Second, in weblate/static/editor/full.js, the WLT.MT.get function, which handles machine translation suggestions, was similarly vulnerable. It would render the origin of a suggestion directly as HTML and use the origin_url without validation, creating a vector for XSS through crafted suggestion data.
The patch remediates these vulnerabilities by replacing the unsafe string-based HTML construction with safer DOM manipulation methods. Specifically, it now uses textContent to insert data, ensuring that it is treated as plain text and not parsed as HTML. It also introduces a new utility, WLT.URLs, to validate and sanitize URLs before they are used in href attributes, preventing javascript: URL attacks. By making these changes, the patch ensures that user-provided content is safely rendered, mitigating the XSS risk.
showResultsweblate/static/editor/tools/search.js
WLT.MT.getweblate/static/editor/full.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| weblate | pip | < 2026.5 | 2026.5 |