@WALINE/CLIENT · CVE-2026-64671 · Package
NO FIX YET · SEE WHAT TO DO
Waline's client UserList widget writes commenter nick and link fields into the page as raw HTML without escaping. An unauthenticated visitor can post a comment with a crafted link value that runs JavaScript in the browser of anyone who views a page embedding the widget.
first public Jul 5, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites that load @waline/client and embed the UserList widget on a public page are exposed. Anyone can post a comment with a crafted link value (and nick when Akismet is off), and it runs script in every visitor's browser. If a logged-in user or admin views it, the script can read the Waline JWT in localStorage. Sites that only use the default comment list, or do not embed UserList, can skip it.
Not affected if auth-required, no-userlist-widget
Who cares @waline/client, comments, javascript, npm, userlist, waline, xss
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x"><img src=x onerror=...> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.16.2 on npm) but no source says they fix this; check the advisory before relying on one