CVE-2026-64671

The Waline comment system (versions 3.15.2 and prior ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue exists in the @waline/client UserList widget , which concatenates server-returned commenter fields, such as the nick and link , directly into root.innerHTML without HTML escaping....

PT-2026-144973

Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by th...

CVE-2026-64671: walinejs waline: Waline is a comment system with backend support

Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by th...