Weblate's Markdown renderer, used for user comments and other content, fails to escape certain attributes. An attacker can embed malicious script fragments that execute when the content is displayed, leading to a client-side XSS condition. The weakness falls under CWE-80. The impact is that an attacker can run arbitrary JavaScript in the victim’s browser session, potentially exfiltrating data or hijacking the interface.

The vulnerability affects all Weblate releases prior to version 5.17.1 distributed by WeblateOrg. It is present in the comment rendering and any other user‑provided markdown content rendered by the application. No specific sub‑versions are listed in the advisory.

The CVSS base score of 4.3 suggests a moderate risk level. EPSS is not available, so the probability of exploitation is unknown. The issue is included in a public advisory but no exploit has been reported, and it is not listed in CISA KEV. The likely attack vector is an attacker posting crafted markdown in a user comment, which is inferred from the description. This flow would allow execution of malicious JavaScript in the victim’s browser.