CVE-2026-64671
HighCVSS 7.2Summary
In Waline versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The nick and link fields are stored and returned verbatim (only the comment body is sanitized) and the link is never sent to the spam filter, so an unauthenticated visitor can achieve stored XSS that executes without interaction in the browser of every visitor to a page embedding the UserList widget.
Risk Assessment
An unauthenticated attacker can inject a script that executes automatically in the browsers of all visitors to pages embedding the UserList widget. This may lead to session theft and other attacks.
Recommendation
No public patches exist — consider disabling the UserList widget or implementing your own escaping of the nick and link fields. Monitor Waline releases and apply a fix when available.
Other vulnerabilities in Waline
See all- CVE-2026-64670Critical
In Waline versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer, injecting it via v-html. When editing a comment, the editor is seeded with the raw, un-sanitized body, so an administrator who clicks Edit on an attacker's comment renders that raw HTML in their own session, leading to stored XSS and privilege escalation.
- CVE-2026-55369Medium
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently drops the field rather than rejecting the request, producing an empty filter that matches all users, and the password is verified against the first user (the administrator). This is a partial authentication bypass that removes the email factor for the administrator account, enables user enumeration, and amplifies credential-stuffing.
Original NVD description (English source)
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x"><img src=x onerror=...> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS