CVE-2026-64670
Last modified
CVE-2026-64670 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html.
Description
Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| walinejs | waline | <= 3.15.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-64670?
How severe is CVE-2026-64670?
How do I fix CVE-2026-64670?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-64664Statamic is a Laravel and Git powered content management sys…4.3
- CVE-2026-64665Statamic is a Laravel and Git powered content management sys…8.1
- CVE-2026-64666pam_usb provides hardware authentication for Linux using rem…7.1
- CVE-2026-64667pam_usb provides hardware authentication for Linux using rem…4.4
- CVE-2026-64668pam_usb provides hardware authentication for Linux using rem…7.4
- CVE-2026-64669pam_usb provides hardware authentication for Linux using rem…7.4
- CVE-2026-64671Waline is a comment system with backend support. In versions…7.2
- CVE-2026-64672Terragrunt is a flexible orchestration tool that allows Infr…4.4
- CVE-2026-64676Kata Containers is an open source implementation of lightwei…5.7
- CVE-2026-64677Anki is a program for creating and reviewing flashcards. Pri…5.9
- CVE-2026-64678NOsql Object (NO2 a.k.a Nitrite) database is an open source …9.8
- CVE-2026-64679Atlantis is a self-hosted golang application that listens fo…8.1
Are you affected by CVE-2026-64670?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST