CVE-2026-64670

Name of the Vulnerable Software and Affected Versions Waline versions prior to 3.15.3

Description A stored Cross-Site Scripting (XSS) issue exists in the @waline/client component. The system renders the comment editor's live preview using the marked library without a sanitizer in utils/markdown.ts, and the resulting preview is injected via v-html. When a moderator or administrator edits a malicious comment, the editor is seeded with the raw, un-sanitized orig variable, causing the attacker's HTML to execute in the administrator's session. This allows an unauthenticated commenter to achieve privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.