---
id: "CVE-2026-64670"
page: "https://infrastack.ai/live/CVE-2026-64670"
kind: "vulnerability"
aliases: ["CVE-2026-64670"]
title: "Waline: comment editor preview runs attacker HTML in admin sessions"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@waline/client", "fixed": [], "affected": "<= 3.15.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["@waline/client", "comments", "npm", "package", "self-hosted", "waline", "xss"]
not_affected_if: ["no-admin-edit-use", "not-using-waline"]
published_at: "2026-11-11T05:19:51+00:00"
first_seen_at: "2026-11-11T05:25:40+00:00"
updated_at: "2026-11-11T05:27:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64670", "first_seen_at": "2026-11-11T05:25:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T05:27:06+00:00"}]
exploit_sources: []
---

# Waline: comment editor preview runs attacker HTML in admin sessions

Link for people: https://infrastack.ai/live/CVE-2026-64670 (this .md is for agents)

Waline's comment editor renders a comment's raw, unsanitized body as HTML when an administrator clicks Edit. A commenter who posts crafted HTML can run script in the admin's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@waline/client affected <= 3.15.2 fixed no fixed version listed

## How to check

Run npm ls @waline/client (or check your lockfile): version <= 3.15.2 is affected per the advisory. Exposed if anonymous users can post comments and an admin or moderator uses the Edit button in the Waline client.

## Fix

No patched version listed in the vendor advisory (affected <= 3.15.2). Interim: avoid clicking Edit on untrusted comments, or patch parseMarkdown output with DOMPurify as the advisory suggests. 3.16.0 release notes do not mention this fix.

## Timeline

- 2026-11-11T05:25:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64670
- 2026-11-11T05:27:06+00:00 analyst — GHSA-crj3-q72p-ggqm read: affected <=3.15.2, patched versions None; PoC in advisory (anonymous POST /api/comment with img onerror, fires when admin clicks Edit, steals JWT from localStorage). @waline/client 3.16.0 exists in releases but its notes do not mention a sanitizer fix, so not claimed as fixed.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm

## From the sources

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_