CyberSecBulletin

Walinejs vulnerabilities

We track 2 vulnerabilities in Walinejs products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.

2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score

Latest Walinejs vulnerabilities

  • 7.2 High severity

    waline: Improper Neutralization of Input During Web Page Generation

    CVE-2026-64671Walinejs

    Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link a

  • 9.3 Critical severity

    waline: Improper Neutralization of Input During Web Page Generation

    CVE-2026-64670Walinejs

    Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the edi