{"id":"CVE-2026-64671","summary":"Stored XSS in the @waline/client UserList widget via an unescaped commenter link field","details":"Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x\"\u003e\u003cimg src=x onerror=...\u003e achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.","aliases":["GHSA-7w94-hxwm-gg99"],"modified":"2026-11-12T02:48:38.404639374Z","published":"2026-11-11T03:42:13.103Z","database_specific":{"cwe_ids":["CWE-116","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64671.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64671.json"},{"type":"ADVISORY","url":"https://github.com/walinejs/waline/security/advisories/GHSA-7w94-hxwm-gg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64671"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/walinejs/waline","events":[{"introduced":"0"},{"last_affected":"c92e29cf768913864ef98d8326227e6a68ce89b6"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"last_affected":"3.15.2"}]},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"3.15.2"}]}]}}],"versions":["@waline/client@3.15.1","@waline/client@3.15.2","@waline/client@3.15.0","@waline/vercel@1.40.1","@waline/vercel@1.40.0","@waline/client@3.14.0","@waline/vercel@1.36.1","@waline/client@3.3.0","@waline/client@3.1.3","@waline/client@3.1.2","@waline/vercel@1.31.12","@waline/client@3.0.0-alpha.12","@waline/vercel@1.31.11","@waline/vercel@1.31.10","@waline/vercel@1.31.9","@waline/client@3.0.0-alpha.11","@waline/client@3.0.0-alpha.4","@waline/client@3.0.0-alpha.3","@waline/client@3.0.0-alpha.2","@waline/client@3.0.0-alpha.1","@waline/client@2.15.8","@waline/vercel@1.31.4","@waline/vercel@1.31.3","@waline/client@2.15.6","@waline/vercel@1.31.2","@waline/vercel@1.31.1","@waline/vercel@1.31.0","@waline/vercel@1.30.5","@waline/vercel@1.30.4","@waline/vercel@1.30.3","@waline/vercel@1.30.2","@waline/client@2.15.5-alpha.0","@waline/client@2.15.4","@waline/client@2.15.3","@waline/vercel@1.30.1","@waline/vercel@1.30.0","@waline/vercel@1.29.0","@waline/client@2.15.0","@waline/vercel@1.28.2","@waline/vercel@1.28.1","@waline/vercel@1.28.0","@waline/vercel@1.28.0-alpha.2","@waline/vercel@1.28.0-alpha.1","@waline/vercel@1.28.0-alpha.0","@waline/vercel@1.27.1","@waline/vercel@1.27.0","@waline/vercel@1.26.5","@waline/client@2.14.8","@waline/vercel@1.26.4","@waline/vercel@1.26.3-deta-alpha.0","@waline/vercel@1.26.3-deta","@waline/vercel@1.26.3","@waline/vercel@1.26.2","@waline/vercel@1.26.1","@waline/vercel@1.26.0","@waline/client@2.14.3","@waline/vercel@1.25.2","@waline/client@2.14.2","@waline/vercel@1.25.1","@waline/client@2.14.1","@waline/client@2.14.0","@waline/client@2.13.1","@waline/vercel@1.25.0","@waline/vercel@1.24.1","@waline/vercel@1.24.0","@waline/client@2.13.0","@waline/vercel@1.23.5","@waline/vercel@1.23.4","@waline/client@2.12.0","@waline/vercel@1.23.3","@waline/client@2.11.3","@waline/client@2.11.2","@waline/vercel@1.23.2","@waline/vercel@1.23.1","@waline/client@2.11.1","@waline/client@2.11.0","@waline/vercel@1.23.0","@waline/vercel@1.22.0","@waline/client@2.10.0","@waline/client@2.9.1","@waline/client@2.9.0","@waline/client@2.8.1","@waline/vercel@1.21.0","@waline/client@2.8.0","@waline/vercel@1.20.1","@waline/client@2.7.1","@waline/client@2.7.0","@waline/vercel@1.20.0","@waline/client@2.6.4","@waline/vercel@1.19.4","@waline/vercel@1.19.3","@waline/client@2.6.3","@waline/vercel@1.19.2","@waline/vercel@1.19.1","@waline/vercel@1.19.0","@waline/client@2.6.2","@waline/vercel@1.18.9","@waline/vercel@1.18.8","@waline/vercel@1.18.7","@waline/client@2.6.1","@waline/client@2.6.0","@waline/vercel@1.18.6","@waline/client@2.5.1","@waline/client@2.5.0","@waline/vercel@1.18.5","@waline/vercel@1.18.4","@waline/vercel@1.18.3","@waline/vercel@1.18.2","@waline/vercel@1.18.1","@waline/client@2.4.1","@waline/client@2.4.0","@waline/vercel@1.18.0","@waline/vercel@1.17.4","@waline/vercel@1.17.3","@waline/vercel@1.17.2","@waline/vercel@1.17.1","@waline/client@2.3.1","@waline/client@2.3.0","@waline/vercel@1.17.0","@waline/client@2.2.0","@waline/vercel@1.16.0","@waline/vercel@1.15.3","@waline/vercel@1.15.2","@waline/vercel@1.15.1","@waline/client@2.1.0","@waline/vercel@1.15.0","@waline/vercel@1.14.0","@waline/vercel@1.13.6","@waline/client@2.0.7","@waline/client@2.0.6","@waline/client@2.0.5","@waline/client@2.0.4","@waline/client@2.0.3","@waline/client@2.0.2","@waline/client@2.0.1","@waline/client@2.0.0","@waline/client@2.0.0-alpha.4","@waline/client@2.0.0-alpha.3","@waline/client@2.0.0-alpha.2","@waline/client@2.0.0-alpha.1","@waline/client@2.0.0-alpha.0","@waline/vercel@1.13.5","@waline/vercel@1.13.4","@waline/vercel@1.13.3","@waline/vercel@1.13.2","@waline/vercel@1.13.1","@waline/vercel@1.13.0","@waline/vercel@1.12.0","@waline/vercel@1.11.0","@waline/vercel@1.10.1","@waline/vercel@1.10.0","@waline/vercel@1.9.0","@waline/vercel@1.8.1","@waline/client@1.6.0","@waline/vercel@1.8.0","@waline/client@1.5.4","@waline/client@1.5.3","@waline/vercel@1.7.0","@waline/vercel@1.6.1","@waline/vercel@1.6.0","@waline/vercel@1.5.1","@waline/vercel@1.5.0","@waline/vercel@1.4.1","@waline/vercel@1.4.0","@waline/vercel@1.3.2","@waline/vercel@1.3.1","@waline/vercel@1.3.0","@waline/client@1.5.2","@waline/vercel@1.2.6","@waline/vercel@1.2.5","@waline/client@1.5.1","@waline/client@1.5.0","@waline/client@1.4.0","@waline/vercel@1.2.4","@waline/client@1.3.11","@waline/vercel@1.2.3","@waline/vercel@1.2.2","@waline/vercel@1.2.1","@waline/vercel@1.2.0","@waline/vercel@1.1.2","@waline/client@1.3.10","@waline/vercel@1.1.1","@waline/client@1.3.9","@waline/client@1.3.8","@waline/vercel@1.1.0","@waline/vercel@1.0.0","@waline/client@1.3.5","@waline/vercel@0.26.9","@waline/vercel@0.26.8","@waline/vercel@0.26.7","@waline/vercel@0.26.6","@waline/vercel@0.26.5","@waline/client@1.3.4","@waline/vercel@0.26.4","@waline/vercel@0.26.3","@waline/vercel@0.26.2","@waline/vercel@0.26.1","@waline/vercel@0.26.0","@waline/client@1.3.3","@waline/client@1.3.2","@waline/client@1.3.1","@waline/vercel@0.25.0","@waline/client@1.3.0","@waline/client@1.2.4","@waline/vercel@0.24.1","@waline/client@1.2.3","@waline/client@1.2.2","@waline/client@1.2.1","@waline/client@1.2.0","@waline/client@1.1.3","@waline/client@1.1.2","@waline/client@1.1.1","@waline/client@1.1.0","@waline/client@1.0.2","@waline/client@1.0.1","@waline/client@1.0.0","@waline/client@1.0.0-beta.5","@waline/client@1.0.0-beta.4","@waline/client@1.0.0-beta.3","@waline/client@1.0.0-beta.2","@waline/client@1.0.0-beta.1","@waline/client@0.17.0","@waline/client@0.16.2","@waline/client@0.16.1","@waline/vercel@0.24.0","@waline/client@0.16.0","@waline/client@0.15.0","@waline/vercel@0.23.13","@waline/vercel@0.23.12","@waline/vercel@0.23.10","@waline/client@0.14.8","@waline/vercel@0.23.9","@waline/vercel@0.23.8","@waline/vercel@0.23.7","@waline/vercel@0.23.6","@waline/vercel@0.23.5","@waline/client@0.14.7","@waline/vercel@0.23.4","@waline/vercel@0.23.3","@waline/vercel@0.23.2","@waline/vercel@0.23.1","@waline/vercel@0.23.0","@waline/client@0.14.6","@waline/client@0.14.5","@waline/client@0.14.4","@waline/vercel@0.22.6","@waline/client@0.14.3","@waline/vercel@0.22.5","@waline/client@0.14.2","@waline/vercel@0.22.4","@waline/client@0.14.1","@waline/client@0.14.0","@waline/vercel@0.22.3","@waline/vercel@0.22.2","@waline/vercel@0.22.1","@waline/vercel@0.22.0","@waline/client@0.13.0","@waline/vercel@0.21.12","@waline/vercel@0.21.11","@waline/vercel@0.21.10","@waline/vercel@0.21.9","@waline/vercel@0.21.8","@waline/vercel@0.21.7","@waline/vercel@0.21.6","@waline/vercel@0.21.5","@waline/vercel@0.21.4","@waline/vercel@0.21.3","@waline/vercel@0.21.2","@waline/vercel@0.21.1","@waline/vercel@0.21.0","@waline/client@0.12.2","@waline/client@0.12.1","@waline/vercel@0.20.4","@waline/vercel@0.20.3","@waline/vercel@0.20.2","@waline/vercel@0.20.1","@waline/vercel@0.20.0","@waline/client@0.12.0","@waline/vercel@0.19.0","@waline/client@0.11.0","@waline/client@0.10.2","@waline/vercel@0.18.1","@waline/client@0.10.1","@waline/vercel@0.18.0","@waline/client@0.10.0","@waline/vercel@0.17.2","@waline/vercel@0.17.1","@waline/vercel@0.17.0","@waline/vercel@0.16.1","@waline/vercel@0.16.0","@waline/vercel@0.15.2","@waline/vercel@0.15.1","@waline/vercel@0.15.0","@waline/vercel@0.14.1","@waline/vercel@0.14.0","@waline/client@0.9.0","@waline/client@0.8.6","@waline/vercel@0.13.6","@waline/client@0.8.5","@waline/vercel@0.13.5","@waline/vercel@0.13.4","@waline/vercel@0.13.3","@waline/client@0.8.3","@waline/client@0.8.2","@waline/client@0.8.1","@waline/vercel@0.13.2","@waline/vercel@0.13.1","@waline/client@0.7.0","@waline/vercel@0.13.0","@waline/client@0.6.0","@waline/vercel@0.12.0","@waline/client@0.5.3","@waline/client@0.5.2","@waline/vercel@0.11.0","@waline/vercel@0.10.2","@waline/vercel@0.10.1","@waline/vercel@0.10.0","@waline/client@0.5.1","@waline/vercel@0.9.0","@waline/vercel@0.8.7","@waline/client@0.5.0","@waline/vercel@0.8.6","@waline/client@0.4.3","@waline/vercel@0.8.5","@waline/vercel@0.8.4","@waline/vercel@0.8.3","@waline/vercel@0.8.2","@waline/vercel@0.8.1","@waline/vercel@0.8.0","@waline/vercel@0.7.2","@waline/vercel@0.7.1","@waline/vercel@0.7.0","@waline/vercel@0.6.0","@waline/vercel@0.5.5","@waline/vercel@0.5.4","@waline/vercel@0.5.3","@waline/vercel@0.5.2","@waline/vercel@0.5.1","@waline/client@0.4.2","@waline/vercel@0.5.0","@waline/vercel@0.4.0","@waline/client@0.4.1","@waline/client@0.3.1","@waline/vercel@0.3.0","@waline/client@0.2.0","@waline/vercel@0.2.1","@waline/vercel@0.2.0","@waline/vercel@0.1.2","@waline/client@0.1.2","@waline/vercel@0.1.1","@waline/vercel@0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64671.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}