---
id: "CVE-2026-64671"
page: "https://infrastack.ai/live/CVE-2026-64671"
kind: "vulnerability"
aliases: ["CVE-2026-64671"]
title: "Waline: unescaped commenter fields enable stored cross-site scripting"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@waline/client", "fixed": [], "affected": "<= 3.15.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["@waline/client", "comments", "javascript", "npm", "package", "userlist", "waline", "xss"]
not_affected_if: ["auth-required", "no-userlist-widget"]
published_at: "2026-11-11T05:19:51+00:00"
first_seen_at: "2026-11-11T05:25:40+00:00"
updated_at: "2026-11-11T05:27:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64671", "first_seen_at": "2026-11-11T05:25:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T05:27:10+00:00"}]
exploit_sources: []
---

# Waline: unescaped commenter fields enable stored cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-64671 (this .md is for agents)

Waline's client UserList widget writes commenter nick and link fields into the page as raw HTML without escaping. An unauthenticated visitor can post a comment with a crafted link value that runs JavaScript in the browser of anyone who views a page embedding the widget.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@waline/client affected <= 3.15.2 fixed no fixed version listed

## How to check

- Run npm ls @waline/client or check package.json and the lockfile; 3.15.2 and earlier are affected.
- Search your code for the UserList widget (userList / user list component); the default CommentCard comment list is not affected.
- Check your Waline server for comments whose link or nick contain quotes, angle brackets or onerror=.

## Fix

No patched version listed in the maintainer advisory (GHSA-7w94-hxwm-gg99). Until one is published, stop rendering the UserList widget, or HTML-escape nick, link, avatar and label in packages/client/src/widgets/userList.ts. Newer @waline/client releases exist (3.16.2 on npm) but no source says they fix this; check the advisory before relying on one.

## Timeline

- 2026-11-11T05:25:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64671
- 2026-11-11T05:27:10+00:00 analyst — Read GHSA-7w94-hxwm-gg99: affected <= 3.15.2, patched versions none. npm latest is 3.16.2 but no source ties it to a fix; unverified.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/walinejs/waline/security/advisories/GHSA-7w94-hxwm-gg99

## From the sources

Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x"><img src=x onerror=...> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_