{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@waline/client--3.15.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-64671"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@waline/client (\u003c= 3.15.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eWaline versions 3.15.2 and prior contain a stored cross-site scripting vulnerability in the @waline/client UserList widget. The widget builds its DOM by concatenating server-returned 'nick' and 'link' commenter fields into root.innerHTML without HTML escaping. Because the 'link' field bypasses spam filtering, an unauthenticated visitor can inject payloads that execute in the browser of every visitor to a page embedding the UserList widget. There are no publicly available patches at the time of publication.\u003c/p\u003e\n","date_modified":"2026-11-11T13:58:27Z","date_published":"2026-11-11T13:58:27Z","id":"https://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64671/","summary":"Waline versions 3.15.2 and prior are vulnerable to stored cross-site scripting in the @waline/client UserList widget. An unauthenticated attacker can inject malicious payloads into comment metadata that execute in the browsers of page visitors.","title":"Waline: Stored Cross-Site Scripting in @waline/client (CVE-2026-64671)","url":"https://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64671/"}],"language":"en","title":"CraftedSignal Threat Feed - @Waline/Client (\u003c= 3.15.2)","version":"https://jsonfeed.org/version/1.1"}