The wlc tool, a command-line client for Weblate's REST API, prior to version 2.0.0, improperly neutralizes input when generating HTML output. Specifically, it embeds API response data directly into HTML without escaping special characters, leading to a cross-site scripting (CWE-79) vulnerability. This can result in the execution of arbitrary scripts in the context of the user's browser when viewing the HTML output. The vulnerability has a CVSS 3.1 base score of 5.1, indicating medium severity, and was fixed in wlc version 2.0.0.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser when viewing the HTML output generated by wlc. This may lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, exploitation requires user interaction (UI:R) and high privileges (PR:H) on a network attack vector (AV:N). There are no known exploits in the wild at this time.

A fixed version of wlc (version 2.0.0) is available that addresses this vulnerability by properly escaping API response data in HTML output. Users should upgrade to version 2.0.0 or later to remediate this issue. Since this is not a cloud service and no vendor advisory is provided, patch status is confirmed by the version update mentioned in the description.