Waline vulnerabilities

In Waline versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The nick and link fields are stored and returned verbatim (only the comment body is sanitized) and the link is never sent to the spam filter, so an unauthenticated visitor can achieve stored XSS that executes without interaction in the browser of every visitor to a page embedding the UserList widget.

In Waline versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer, injecting it via v-html. When editing a comment, the editor is seeded with the raw, un-sanitized body, so an administrator who clicks Edit on an attacker's comment renders that raw HTML in their own session, leading to stored XSS and privilege escalation.

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently drops the field rather than rejecting the request, producing an empty filter that matches all users, and the password is verified against the first user (the administrator). This is a partial authentication bypass that removes the email factor for the administrator account, enables user enumeration, and amplifies credential-stuffing.