https://feed.craftedsignal.io/products/@waline/client--3.15.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:58:27 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64671/Wed, 11 Nov 2026 13:58:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64671/Waline versions 3.15.2 and prior are vulnerable to stored cross-site scripting in the @waline/client UserList widget. An unauthenticated attacker can inject malicious payloads into comment metadata that execute in the browsers of page visitors.<p>Waline versions 3.15.2 and prior contain a stored cross-site scripting vulnerability in the @waline/client UserList widget. The widget builds its DOM by concatenating server-returned 'nick' and 'link' commenter fields into root.innerHTML without HTML escaping. Because the 'link' field bypasses spam filtering, an unauthenticated visitor can inject payloads that execute in the browser of every visitor to a page embedding the UserList widget. There are no publicly available patches at the time of publication.</p> highadvisory