What happened
CVE-2026-64671 affects Waline, a comment system with backend support. In affected versions, the <code>@waline/client</code> UserList widget builds page content by inserting commenter fields into the page without HTML escaping. The commenter nickname and link are stored and returned verbatim; only the comment body is sanitised, and the link field is not sent to the spam filter. An unauthenticated visitor can submit a comment with a crafted link field. When a page embeds the UserList widget, the stored content executes in the browser of each visitor to that page, without user interaction. The service is reachable over a network and can be attacked directly. Exploitation is confirmed in the wild. The severity is high, with an NVD score of 7.2.
Who is affected
Organisations running Waline versions 3.15.2 and prior are affected. The vulnerable component is Waline’s <code>@waline/client</code> UserList widget. The flaw is relevant to deployments where a page embeds that widget. The NVD analysis is still in progress, so the scope may change.
Recommended actions
- Restrict network exposure of Waline services to reduce the ability to submit crafted comments directly.
- Place access controls in front of exposed services to limit access to the attack path.
- Segment affected services from other systems to limit the impact of compromise.
- Check the vendor advisory for fixed versions and apply a vendor-identified fixed version where available.
