Waline: Stored Cross-Site Scripting via comment editor (CVE-2026-64670)
The @waline/client component (version 3.15.2 and prior) renders the comment editor's live preview without sanitization, allowing unauthenticated attackers to perform stored XSS against administrators or moderators who edit the malicious comment.
CVE search metadata
CVE search record: CVE-2026-64670. Severity: critical. CVSS: 9.3. KEV: no. Product: @waline/client (3.15.2 and prior). Brief: Waline: Stored Cross-Site Scripting via comment editor (CVE-2026-64670). Brief link: https://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64670/
Triage facts
Revision 1- Applicability
- @waline/client (3.15.2 and prior)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-64670 affects the @waline/client component of the Waline comment system. The live preview functionality renders user-supplied content using v-html without sanitization. When an administrator or comment owner edits a comment, the raw, un-sanitized body is seeded into the editor and rendered in the user's session. An unauthenticated attacker can leverage this to execute stored XSS against a moderator. At the time of publication, there are no publicly available patches.