Waline: Stored cross-site scripting in UserList widget via unescaped commenter link
Summary
Waline up to and including 3.15.2 is a comment system whose @waline/client UserList widget inserts commenter nick and link values into the page without HTML escaping. An unauthenticated visitor can post a comment with a crafted link value that stores a script, which then runs in the browser of every visitor to a page that embeds the widget, with no user interaction. The link field is not checked by the spam filter, so the attack works on a default installation. Session tokens in browser storage could be stolen, which may lead to account takeover of logged-in users or administrators who view the page.
Affected
- Waline (@waline/client) versions <= 3.15.2
- Only sites that embed the UserList widget are affected by the client-side injection
Fixed in
Unknown. No patch was publicly available at publication. The npm package is at 3.16.2, but no source confirms that this release contains the fix.
Workaround
- Remove the UserList widget from pages until a fix is confirmed
- Review stored comments in the admin dashboard for link values containing markup instead of a plain URL
- Deploy a Content Security Policy that blocks inline scripts and inline event handlers; this limits the impact but is not a fix
Exploitation
- Not known to be exploited in the wild, according to one aggregator
- Not listed in CISA KEV
- No public proof of concept found; this does not prove none exists
- VulDB rates exploitation as easy (scoring judgement, not evidence of attacks)
Our recommendation
- Identify all sites running Waline <= 3.15.2 and check whether they use the UserList widget
- Apply the workarounds above now
- Monitor the GitHub advisory GHSA-7w94-hxwm-gg99 and upgrade as soon as a fixed version is confirmed
- Check whether CVE-2026-64670, a related Waline XSS, also applies and fix it at the same time
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7w94-hxwm-gg99 github.com
- CVE Record CVE-2026-64671 www.cve.org
- OpenCVE CVE-2026-64671 app.opencve.io
- VulDB entry 435599 vuldb.com
- npm package @waline/client www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:45.
Original description (NVD)
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x"><img src=x onerror=...> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.