Weblate versions prior to 5.17.1 contain a cross-site scripting (XSS) vulnerability in the Markdown renderer used for user comments and other user-provided content. This vulnerability arises because some attributes are not properly sanitized, allowing an attacker to inject code into the HTML. However, Weblate's strict Content Security Policy (CSP) helps mitigate the risk of exploitation. The issue was identified and fixed in version 5.17.1.