Weblate vulnerable to XSS via crafted Markdown

Impact

The Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes.

Patches

• https://github.com/WeblateOrg/weblate/pull/19259

Workarounds

Even though the attacker might be able to inject code into the HTML, the Weblate's strict CSP should mitigate the risks.

Acknowlegement

Michal Čihař has identified and fixed this vulnerability.