Skip to content
OpenAdvisories

Vendor

walinejs

3 known vulnerabilities.

Products

waline 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-64670

    Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

    Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the ed…

    walinejs waline