https://feed.craftedsignal.io/products/@waline/client-3.15.2-and-prior/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 13:58:20 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64670/Wed, 11 Nov 2026 13:58:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-waline-xss-cve-2026-64670/The @waline/client component (version 3.15.2 and prior) renders the comment editor's live preview without sanitization, allowing unauthenticated attackers to perform stored XSS against administrators or moderators who edit the malicious comment.<p>CVE-2026-64670 affects the @waline/client component of the Waline comment system. The live preview functionality renders user-supplied content using <code>v-html</code> without sanitization. When an administrator or comment owner edits a comment, the raw, un-sanitized body is seeded into the editor and rendered in the user's session. An unauthenticated attacker can leverage this to execute stored XSS against a moderator. At the time of publication, there are no publicly available patches.</p> criticaladvisory