{"id":"CVE-2026-64670","kind":"vulnerability","aliases":["CVE-2026-64670"],"related":[],"title":"Waline: comment editor preview runs attacker HTML in admin sessions","description":"Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.","summary":"Waline's comment editor renders a comment's raw, unsanitized body as HTML when an administrator clicks Edit. A commenter who posts crafted HTML can run script in the admin's browser session.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@waline/client","fixed":[],"affected":"<= 3.15.2","ecosystem":"npm"}],"ecosystems":[],"tags":["@waline/client","comments","npm","package","self-hosted","waline","xss"],"not_affected_if":["no-admin-edit-use","not-using-waline"],"how_to_check":"Run npm ls @waline/client (or check your lockfile): version <= 3.15.2 is affected per the advisory. Exposed if anonymous users can post comments and an admin or moderator uses the Edit button in the Waline client.","fix":"No patched version listed in the vendor advisory (affected <= 3.15.2). Interim: avoid clicking Edit on untrusted comments, or patch parseMarkdown output with DOMPurify as the advisory suggests. 3.16.0 release notes do not mention this fix.","status":"open","published_at":"2026-11-11T05:19:51+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","triaged_at":"2026-11-11T05:26:34+00:00","updated_at":"2026-11-11T05:27:06+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-11T05:26:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Waline: comment editor preview runs attacker HTML in admin sessions","impact":"high","summary":"Waline's comment editor renders a comment's raw, unsanitized body as HTML when an administrator clicks Edit. A commenter who posts crafted HTML can run script in the admin's browser session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["waline","@waline/client","self-hosted","comments"],"confidence":0.7,"fix_status":"none","needs_auth":"yes","worst_case":"Attacker script runs in moderator session, taking admin actions","analyst_note":"Confirm the fixed version and the vendor advisory on GitHub; sources say no patch was available at publication.","how_to_check":"- Check the `@waline/client` version in your lockfile; the description names `3.15.2` and prior as affected.\n- Check whether your Waline deployment lets anonymous users post comments that admins later edit.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-admin-edit-use","not-using-waline"],"who_is_affected":"Sites that run Waline with `@waline/client` at version `3.15.2` or earlier, where administrators or moderators use the edit feature on comments. Anyone who can post comments can plant the payload, and it fires when a privileged user clicks Edit. Sites that do not use Waline or that have no privileged editors have less exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00074,"input_tokens":4659,"output_tokens":549,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vendor advisory on GitHub; sources say no patch was available at publication.","search":"'-2026':12A,15A '-64670':13A,16A '3.15.2':70C 'achiev':147C 'admin':9A,56B 'administr':42B,116C,125C 'attack':6A,131C,136C 'avail':169C 'backend':66C 'bodi':37B,113C 'browser':58B 'click':43B,127C,160C 'comment':2A,19B,29B,33B,46B,63C,76C,98C,107C,119C,133C,146C 'craft':49B 'cve':11A,14A 'edit':44B,100C,122C,128C,159C 'editor':3A,30B,77C,102C 'escal':150C 'host':24B 'html':7A,39B,50B,95C,139C 'inject':91C 'live':79C 'mark':82C 'moder':155C 'npm':20B 'orig':114C 'owner':120C 'packag':21B 'patch':170C 'post':48B 'preview':4A,80C,89C 'prior':72C 'privileg':149C 'privilege-escal':148C 'public':164C,168C 'raw':35B,109C,138C 'render':31B,74C,134C 'run':5A,52B 'sanit':85C,112C 'script':53B 'seed':104C 'self':23B 'self-host':22B 'session':10A,59B,143C 'singl':158C 'store':151C 'support':67C 'system':64C 'time':162C 'un':111C 'un-sanit':110C 'unauthent':145C 'unsanit':36B 'utils/markdown.ts':86C 'v':94C 'v-html':93C 'version':69C 'walin':1A,25B,27B,60C 'waline/client':17A,18B,73C 'xss':26B,152C","nicknames":[],"mitigations":[],"who_affected":"Sites that run Waline with `@waline/client` at version `3.15.2` or earlier, where administrators or moderators use the edit feature on comments. Anyone who can post comments can plant the payload, and it fires when a privileged user clicks Edit. Sites that do not use Waline or that have no privileged editors have less exposure.","tier":"B","verified":{"products":{"at":"2026-11-11T05:27:06Z","by":"analyst","doc":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm","run_id":3500},"who_affected":{"at":"2026-11-11T05:27:06Z","by":"analyst","doc":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm","run_id":3500}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["client"],"ptokens":["client","waline"],"labels":["client","comments","critical","npm","package","selfhosted","waline","xss"],"campaign_type":null,"search_a":"'-2026':12A,15A '-64670':13A,16A 'admin':9A 'attack':6A 'comment':2A 'cve':11A,14A 'editor':3A 'html':7A 'preview':4A 'run':5A 'session':10A 'walin':1A 'waline/client':17A","search_b":"'admin':56B 'administr':42B 'bodi':37B 'browser':58B 'click':43B 'comment':19B,29B,33B,46B 'craft':49B 'edit':44B 'editor':30B 'host':24B 'html':39B,50B 'npm':20B 'packag':21B 'post':48B 'raw':35B 'render':31B 'run':52B 'script':53B 'self':23B 'self-host':22B 'session':59B 'unsanit':36B 'walin':25B,27B 'waline/client':18B 'xss':26B","search_c":"'3.15.2':70C 'achiev':147C 'administr':116C,125C 'attack':131C,136C 'avail':169C 'backend':66C 'bodi':113C 'click':127C,160C 'comment':63C,76C,98C,107C,119C,133C,146C 'edit':100C,122C,128C,159C 'editor':77C,102C 'escal':150C 'html':95C,139C 'inject':91C 'live':79C 'mark':82C 'moder':155C 'orig':114C 'owner':120C 'patch':170C 'preview':80C,89C 'prior':72C 'privileg':149C 'privilege-escal':148C 'public':164C,168C 'raw':109C,138C 'render':74C,134C 'sanit':85C,112C 'seed':104C 'session':143C 'singl':158C 'store':151C 'support':67C 'system':64C 'time':162C 'un':111C 'un-sanit':110C 'unauthent':145C 'utils/markdown.ts':86C 'v':94C 'v-html':93C 'version':69C 'walin':60C 'waline/client':73C 'xss':152C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T15:05:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64670","severity":null,"published_at":"2026-11-11T05:19:51+00:00","modified_at":"2026-11-11T05:19:51+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","fetched_at":"2026-11-11T05:25:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-64670:3500","url":null,"severity":null,"published_at":"2026-11-11T05:27:06+00:00","modified_at":"2026-11-11T05:27:06+00:00","first_seen_at":"2026-11-11T05:27:06+00:00","fetched_at":"2026-11-11T05:27:06+00:00","note":"GHSA-crj3-q72p-ggqm read: affected <=3.15.2, patched versions None; PoC in advisory (anonymous POST /api/comment with img onerror, fires when admin clicks Edit, steals JWT from localStorage). @waline/client 3.16.0 exists in releases but its notes do not mention a sanitizer fix, so not claimed as fixed."}],"documents":[{"id":122880,"url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T15:05:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}