Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

published 2026-07-02 4mo ago modified 2026-11-11 yesterday also EUVD-2026-123129 , GHSA-crj3-q72p-ggqm

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository walinejs/waline. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss: 9.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.

Is CVE-2026-64670 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	@waline/client	<=3.15.2	no fix listed

Affected products

walinejs waline

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-116 Improper Encoding or Escaping of Output

References

github.com /walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm
advisory

Sources

CVE List CVE-2026-64670
NVD CVE-2026-64670
Maintainer advisory GHSA-crj3-q72p-ggqm

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of walinejs/waline published their own advisory on GitHub. Reviewed sources take precedence over it.