CVE-2026-64671

Name of the Vulnerable Software and Affected Versions Waline versions prior to 3.15.2

Description The @waline/client UserList widget fails to escape HTML when concatenating server-returned commenter fields into root.innerHTML. Because the server returns the commenter nick and link verbatim and the link field bypasses the spam filter, an unauthenticated visitor can inject malicious scripts via the link variable. This results in stored cross-site scripting (XSS), where the script executes automatically in the browser of any visitor viewing a page with the UserList widget.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.