CVE-2026-42150: wlc: print_html outputs API data without HTML escaping

April 24, 2026 (updated May 12, 2026)

The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.

References

github.com/WeblateOrg/wlc/commit/0f3e58f6d7457b05d48ef40f579a172c4c8b8469
github.com/WeblateOrg/wlc/pull/1327
github.com/WeblateOrg/wlc/releases/tag/2.0.0
github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3
github.com/advisories/GHSA-gx2m-mcc2-r4p3
nvd.nist.gov/vuln/detail/CVE-2026-42150

Code Behaviors & Features

Detect and mitigate CVE-2026-42150 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →