wlc (Weblate CLI) EUVD-2026-28501

The HTML output format must be explicitly requested by the user (--format=html flag), which is non-default behavior-most users rely on text or JSON output. The attacker must control or inject malicious data into the Weblate API response, typically via: (1) direct compromise of the Weblate instance itself, (2) man-in-the-middle attack if API communications are not HTTPS-enforced, or (3) supply-chain compromise of a data source indexed by Weblate. High API privileges (PR:H per CVSS) are required, meaning the attacker needs valid API credentials or the ability to modify Weblate's database. The target user must actively render the generated HTML file in a web browser rather than inspect it as raw text. These cumulative constraints-opt-in feature, high privileges required, MITM or instance compromise prerequisite, plus user action-make spontaneous exploitation unlikely despite the network vector.

Despite the CVSS score of 5.1 (medium), real-world exploitation risk is significantly constrained by multiple limiting factors. The CVSS vector reveals AV:N (network) but AC:H (high complexity), PR:H (requires high privileges - API credentials), and UI:R (requires user interaction - browser rendering of output file). This contradicts a straightforward remote attack scenario. The vulnerability is restricted to opt-in HTML output format and requires an attacker to control API response data (via compromised Weblate instance, MITM, or injection into a data source queried by the Weblate API). An additional barrier: the attacker needs the target user to actively render the HTML output in a browser rather than view it as plain text. No KEV status, no POC in public repositories, and no evidence of active exploitation reported. This is a stored/reflected XSS in a niche tool with low visibility and high exploitation friction-a classic case of high CVSS but low real-world risk. Organizations using wlc should prioritize patching based on exposure (who has API credentials?) rather than CVSS alone.

An attacker with a compromised or legitimate Weblate API token (PR:H) crafts a specially malicious API response containing embedded JavaScript payloads in string fields (e.g., translation metadata, user names, comments). A wlc user retrieves data using '--format=html', which generates an HTML table or detail page embedding the unescaped payloads. The user then opens this HTML file in a browser (UI:R), triggering execution of the attacker's JavaScript-potentially harvesting session cookies, exfiltrating locally cached data, or redirecting to a phishing site.