Cross-site Scripting in Weblate

TRUNG BÌNH 5.4CVE-2022-24710 · BIT-weblate-2022-24710 · GHSA-6jp6-9rf9-gc66 · Công bố 25/02/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-24710 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng weblate, weblate (weblate).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.75%, cao hơn 55.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.11 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
weblate PyPI	`< 4.11`	`4.11`
weblate weblate	`< 4.11`	`4.11`

Mô tả

Impact

Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.

Patches

The issues were fixed in the 4.11 release. The following commits are addressing it:

f6753a1a1c63fade6ad418fbda827c6750ab0bda
9e19a8414337692cc90da2a91c9af5420f2952f1
22d577b1f1e88665a88b4569380148030e0f8389

Workarounds

You can look for crafted user and language names to see if you were affected.

References

For more information

If you have any questions or comments about this advisory:

Open a topic in discussions
Email us at [email protected]

Mô tả của NVD

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.