CVE-2026-64670
CriticalCVSS 9.3Summary
In Waline versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer, injecting it via v-html. When editing a comment, the editor is seeded with the raw, un-sanitized body, so an administrator who clicks Edit on an attacker's comment renders that raw HTML in their own session, leading to stored XSS and privilege escalation.
Risk Assessment
An unauthenticated commenter can achieve stored XSS in a moderator's session with a single Edit click. This may lead to administrator session compromise.
Recommendation
No public patches exist — consider restricting comment editing or implementing your own preview sanitization. Monitor Waline releases and apply a fix when available.
Other vulnerabilities in Waline
See all- CVE-2026-64671High
In Waline versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The nick and link fields are stored and returned verbatim (only the comment body is sanitized) and the link is never sent to the spam filter, so an unauthenticated visitor can achieve stored XSS that executes without interaction in the browser of every visitor to a page embedding the UserList widget.
- CVE-2026-55369Medium
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently drops the field rather than rejecting the request, producing an empty filter that matches all users, and the password is verified against the first user (the administrator). This is a partial authentication bypass that removes the email factor for the administrator account, enables user enumeration, and amplifies credential-stuffing.
Original NVD description (English source)
Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS