{"id":"CVE-2026-64670","published":"2026-11-11T05:19:51.527","lastModified":"2026-11-11T05:19:51.527","description":"Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79","CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm","tags":[]}],"exploitRefs":[{"url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm","tags":[]}],"hasPoc":true,"ai":{"summary":"Waline comment system versions 3.15.2 and prior contain a stored XSS vulnerability where untrusted HTML in a commenter's body is rendered unsanitized in an administrator's live preview when editing the comment, enabling privilege escalation via social engineering.","exploitability":"Exploitation requires an attacker to post a malicious comment and trick an administrator or comment owner into clicking 'Edit' on that comment; no authentication bypass is needed beyond initial comment submission.","blast_radius":"Successful exploitation allows attackers to execute arbitrary scripts in the context of privileged moderators, potentially enabling session hijacking, data theft, or further compromise of the moderation interface.","remediation":"Upgrade to a version that sanitizes Markdown content before rendering in the live preview (e.g., apply a DOMPurify-based sanitizer to the marked output); as no fixed version is published at time of publication, temporarily disable comment editing functionality or restrict edit access to trusted roles only.","detection":"Monitor server logs for HTTP requests where an administrator accesses the comment-edit endpoint (e.g., /api/comment/edit) with a comment ID containing known malicious HTML/JS patterns in the orig parameter; also inspect browser console errors or DOM manipulation events in admin sessions during preview rendering.","tags":["xss","privilege-escalation","web","stored","sanitization-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:56:36.164Z"}}