PYSEC-2026-2321

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/wlc/PYSEC-2026-2321.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2321
Aliases
Published
2026-05-08T04:16:18.920Z
Modified
2026-07-13T07:15:48.786101852Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.

References

Affected packages

PyPI / wlc

Package

Name
wlc
View open source insights on deps.dev
Purl
pkg:pypi/wlc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.0

Affected versions

0.*
0.0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
0.10
1.*
1.0
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
1.11
1.12
1.13
1.14
1.15
1.16.1
1.17.0
1.17.1
1.17.2

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/wlc/PYSEC-2026-2321.yaml"