Waline: Stored Cross-Site Scripting in @waline/client (CVE-2026-64671)
Waline versions 3.15.2 and prior are vulnerable to stored cross-site scripting in the @waline/client UserList widget. An unauthenticated attacker can inject malicious payloads into comment metadata that execute in the browsers of page visitors.
CVE search metadata
CVE search record: CVE-2026-64671. Severity: high. CVSS: 7.2. KEV: no. Product: @waline/client (<= 3.15.2). Brief: Waline: Stored Cross-Site Scripting in @waline/client (CVE-2026-64671). Brief link: https://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64671/
Triage facts
Revision 1- Applicability
- @waline/client (<= 3.15.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Waline versions 3.15.2 and prior contain a stored cross-site scripting vulnerability in the @waline/client UserList widget. The widget builds its DOM by concatenating server-returned 'nick' and 'link' commenter fields into root.innerHTML without HTML escaping. Because the 'link' field bypasses spam filtering, an unauthenticated visitor can inject payloads that execute in the browser of every visitor to a page embedding the UserList widget. There are no publicly available patches at the time of publication.