Actively exploited cross-site scripting vulnerability in walinejs waline (CVE-2026-64671)
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping.
