Waline: Stored cross-site scripting in comment edit preview
Summary
Waline, an open-source comment system, renders the live preview of the comment editor without sanitizing the HTML. When an administrator or the comment owner clicks Edit on a comment, the raw, unsanitized body is rendered in their browser session. An unauthenticated attacker can submit a comment with malicious HTML that executes script in the moderator's session and can read the stored login token, which may lead to administrative account takeover.
Affected
- @waline/client (npm), versions 3.15.2 and prior
- Vendor advisory lists <= 3.15.2 as affected
Fixed in
Unknown. No patched version was available at the time of publication.
Workaround
- No vendor-published workaround known.
- Limit Edit actions in moderation to trusted accounts until a patch is available.
- Apply a strict Content Security Policy to pages hosting Waline and the moderation view.
Exploitation
- Not known to be exploited in the wild.
- Not listed in the CISA KEV catalogue.
- No public proof of concept known at the time of writing.
Our recommendation
- Inventory all Waline instances and check their client version.
- Monitor GHSA-crj3-q72p-ggqm and upgrade as soon as a fixed release is available.
- Until then, restrict moderation edits to trusted accounts or disable comments temporarily.
- Review existing comments for suspicious HTML or script tags, as a moderator may already have been exposed.
- Check whether CVE-2026-64671 (UserList widget XSS) also applies and patch both together.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-crj3-q72p-ggqm github.com
- OpenCVE: CVE-2026-64670 app.opencve.io
- VulDB: CVE-2026-64670 vuldb.com
- ThreatInt: CVE-2026-64670 cve.threatint.com
- OffSeq Radar: CVE-2026-64670 radar.offseq.com
- Waline project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:21.
Original description (NVD)
Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.