5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-gx2m-mcc2-r4p3

GHSA-gx2m-mcc2-r4p3: wlc: print_html outputs API data without HTML escaping

Impact

The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.

Patches

https://github.com/WeblateOrg/wlc/pull/1327

Workarounds

The only vulnerable code path is HTML output which is opt-in.

References

Weblate thanks @fg0x0 for reporting this on GitHub.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-gx2m-mcc2-r4p3

GHSA-gx2m-mcc2-r4p3:

5.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wlc	pip	< 2.0.0	2.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the print_html function of the Command class in wlc/main.py. This function is responsible for generating HTML output from API data. The root cause of the vulnerability is the lack of HTML escaping when embedding API response data into the HTML output. The provided patch 0f3e58f6d7457b05d48ef40f579a172c4c8b8469 clearly shows the vulnerability and the fix. Before the patch, the print_html function used self.format_output_value to format the data. This function did not perform any HTML escaping, making it possible for an attacker to inject malicious HTML and JavaScript code. The patch introduces a new function, format_html_value, which uses the html.escape function to properly escape the data before it is rendered. The print_html function is then updated to use this new, secure function. The presence of new test cases in wlc/test_main.py that specifically test for this XSS vulnerability further confirms the issue and the effectiveness of the patch. Therefore, any user of wlc who uses the HTML output format with untrusted data is at risk. The vulnerable function is wlc.main.Command.print_html.

Vulnerable functions

Command.print_html

wlc/main.py

The `print_html` function in `wlc/main.py` was vulnerable to cross-site scripting (XSS) because it used the `format_output_value` function, which did not escape HTML entities. An attacker could craft malicious input that would be rendered as HTML in the browser, leading to XSS. The patch replaces `format_output_value` with `format_html_value`, which uses `html.escape` to properly sanitize the output.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.