Log in / Sign up

Vulnerability details

CVE-2026-64670

walinejs waline

Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

CVSS 3.1
9.3Critical

Official description

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.

CVSS scores

ScoreVersionSourceVector
9.3Critical 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected products

VendorProductVersionsSource
walinejs waline <= 3.15.2 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-11-11
Last updated
2026-11-11
State
Published
Assigner (CNA)
GitHub_M
Kolun priority
21 · Low

Exploit prediction (EPSS)

0.35%
Probability of exploitation in 30 days
30%
Percentile (among all CVEs)

Weaknesses (CWE)

  • CWE-79
    Improper Neutralization of Input During Web Page Generation
  • CWE-116
    Improper Encoding or Escaping of Output