CVE-2026-64670: Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.4%
EPSS score, percentile 30.1 of all scored records. A probability estimated by FIRST, not a report of exploitation.
CISA's SSVC assessment in the CVE record lists exploitation as poc.
- How severe?
- 9.3 Critical
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
No patch or vendor advisory is listed in the CVE record. Check walinejs's advisories.
- Which versions are affected?
Affected
- <= 3.15.2
Source: CISA KEV 2026.11.10, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit
Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
No patch, vendor advisory or mitigation is listed in the CVE record. Check walinejs's own security advisories for a fix, and compare your version with the affected versions below.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (1 product)
| Status | Versions |
|---|---|
| Affected | <= 3.15.2 |
Source: CVE List, as of . About the data.
Weakness
CWE-79, CWE-116
- CWE-79: Improper Neutralization of Input During Web Page Generation
- CWE-116: Improper Encoding or Escaping of Output
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| CVE record last updated |