waline vulnerabilities

2 known vulnerabilities in waline from Walinejs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  waline: Improper Neutralization of Input During Web Page Generation

  CVE-2026-64671Nov 11, 2026Walinejs

  Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link a

• 9.3 Critical severity

  waline: Improper Neutralization of Input During Web Page Generation

  CVE-2026-64670Nov 11, 2026Walinejs

  Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the edi