CVE-2026-64671

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-64671

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64671.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-64671

Aliases

GHSA-7w94-hxwm-gg99

Published

2026-11-11T03:42:13Z

Modified

2026-11-12T02:48:38Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS in the @waline/client UserList widget via an unescaped commenter link field

Details

Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x"> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64671.json"
}

References

Affected packages

Git / github.com/walinejs/waline

Affected ranges

Type

GIT

Repo

https://github.com/walinejs/waline

Events

Introduced

Last Affected

c92e29cf768913864ef98d8326227e6a68ce89b6

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "3.15.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "3.15.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

@waline/client@0.*

@waline/client@0.1.2

@waline/client@0.10.0

@waline/client@0.10.1

@waline/client@0.10.2

@waline/client@0.11.0

@waline/client@0.12.0

@waline/client@0.12.1

@waline/client@0.12.2

@waline/client@0.13.0

@waline/client@0.14.0

@waline/client@0.14.1

@waline/client@0.14.2

@waline/client@0.14.3

@waline/client@0.14.4

@waline/client@0.14.5

@waline/client@0.14.6

@waline/client@0.14.7

@waline/client@0.14.8

@waline/client@0.15.0

@waline/client@0.16.0

@waline/client@0.16.1

@waline/client@0.16.2

@waline/client@0.17.0

@waline/client@0.2.0

@waline/client@0.3.1

@waline/client@0.4.1

@waline/client@0.4.2

@waline/client@0.4.3

@waline/client@0.5.0

@waline/client@0.5.1

@waline/client@0.5.2

@waline/client@0.5.3

@waline/client@0.6.0

@waline/client@0.7.0

@waline/client@0.8.1

@waline/client@0.8.2

@waline/client@0.8.3

@waline/client@0.8.5

@waline/client@0.8.6

@waline/client@0.9.0

@waline/client@1.*

@waline/client@1.0.0

@waline/client@1.0.0-beta.1

@waline/client@1.0.0-beta.2

@waline/client@1.0.0-beta.3

@waline/client@1.0.0-beta.4

@waline/client@1.0.0-beta.5

@waline/client@1.0.1

@waline/client@1.0.2

@waline/client@1.1.0

@waline/client@1.1.1

@waline/client@1.1.2

@waline/client@1.1.3

@waline/client@1.2.0

@waline/client@1.2.1

@waline/client@1.2.2

@waline/client@1.2.3

@waline/client@1.2.4

@waline/client@1.3.0

@waline/client@1.3.1

@waline/client@1.3.10

@waline/client@1.3.11

@waline/client@1.3.2

@waline/client@1.3.3

@waline/client@1.3.4

@waline/client@1.3.5

@waline/client@1.3.8

@waline/client@1.3.9

@waline/client@1.4.0

@waline/client@1.5.0

@waline/client@1.5.1

@waline/client@1.5.2

@waline/client@1.5.3

@waline/client@1.5.4

@waline/client@1.6.0

@waline/client@2.*

@waline/client@2.0.0

@waline/client@2.0.0-alpha.0

@waline/client@2.0.0-alpha.1

@waline/client@2.0.0-alpha.2

@waline/client@2.0.0-alpha.3

@waline/client@2.0.0-alpha.4

@waline/client@2.0.1

@waline/client@2.0.2

@waline/client@2.0.3

@waline/client@2.0.4

@waline/client@2.0.5

@waline/client@2.0.6

@waline/client@2.0.7

@waline/client@2.1.0

@waline/client@2.10.0

@waline/client@2.11.0

@waline/client@2.11.1

@waline/client@2.11.2

@waline/client@2.11.3

@waline/client@2.12.0

@waline/client@2.13.0

@waline/client@2.13.1

@waline/client@2.14.0

@waline/client@2.14.1

@waline/client@2.14.2

@waline/client@2.14.3

@waline/client@2.14.8

@waline/client@2.15.0

@waline/client@2.15.3

@waline/client@2.15.4

@waline/client@2.15.5-alpha.0

@waline/client@2.15.6

@waline/client@2.15.8

@waline/client@2.2.0

@waline/client@2.3.0

@waline/client@2.3.1

@waline/client@2.4.0

@waline/client@2.4.1

@waline/client@2.5.0

@waline/client@2.5.1

@waline/client@2.6.0

@waline/client@2.6.1

@waline/client@2.6.2

@waline/client@2.6.3

@waline/client@2.6.4

@waline/client@2.7.0

@waline/client@2.7.1

@waline/client@2.8.0

@waline/client@2.8.1

@waline/client@2.9.0

@waline/client@2.9.1

@waline/client@3.*

@waline/client@3.0.0-alpha.1

@waline/client@3.0.0-alpha.11

@waline/client@3.0.0-alpha.12

@waline/client@3.0.0-alpha.2

@waline/client@3.0.0-alpha.3

@waline/client@3.0.0-alpha.4

@waline/client@3.1.2

@waline/client@3.1.3

@waline/client@3.14.0

@waline/client@3.15.0

@waline/client@3.15.1

@waline/client@3.15.2

@waline/client@3.3.0

@waline/vercel@0.*

@waline/vercel@0.1.0

@waline/vercel@0.1.1

@waline/vercel@0.1.2

@waline/vercel@0.10.0

@waline/vercel@0.10.1

@waline/vercel@0.10.2

@waline/vercel@0.11.0

@waline/vercel@0.12.0

@waline/vercel@0.13.0

@waline/vercel@0.13.1

@waline/vercel@0.13.2

@waline/vercel@0.13.3

@waline/vercel@0.13.4

@waline/vercel@0.13.5

@waline/vercel@0.13.6

@waline/vercel@0.14.0

@waline/vercel@0.14.1

@waline/vercel@0.15.0

@waline/vercel@0.15.1

@waline/vercel@0.15.2

@waline/vercel@0.16.0

@waline/vercel@0.16.1

@waline/vercel@0.17.0

@waline/vercel@0.17.1

@waline/vercel@0.17.2

@waline/vercel@0.18.0

@waline/vercel@0.18.1

@waline/vercel@0.19.0

@waline/vercel@0.2.0

@waline/vercel@0.2.1

@waline/vercel@0.20.0

@waline/vercel@0.20.1

@waline/vercel@0.20.2

@waline/vercel@0.20.3

@waline/vercel@0.20.4

@waline/vercel@0.21.0

@waline/vercel@0.21.1

@waline/vercel@0.21.10

@waline/vercel@0.21.11

@waline/vercel@0.21.12

@waline/vercel@0.21.2

@waline/vercel@0.21.3

@waline/vercel@0.21.4

@waline/vercel@0.21.5

@waline/vercel@0.21.6

@waline/vercel@0.21.7

@waline/vercel@0.21.8

@waline/vercel@0.21.9

@waline/vercel@0.22.0

@waline/vercel@0.22.1

@waline/vercel@0.22.2

@waline/vercel@0.22.3

@waline/vercel@0.22.4

@waline/vercel@0.22.5

@waline/vercel@0.22.6

@waline/vercel@0.23.0

@waline/vercel@0.23.1

@waline/vercel@0.23.10

@waline/vercel@0.23.12

@waline/vercel@0.23.13

@waline/vercel@0.23.2

@waline/vercel@0.23.3

@waline/vercel@0.23.4

@waline/vercel@0.23.5

@waline/vercel@0.23.6

@waline/vercel@0.23.7

@waline/vercel@0.23.8

@waline/vercel@0.23.9

@waline/vercel@0.24.0

@waline/vercel@0.24.1

@waline/vercel@0.25.0

@waline/vercel@0.26.0

@waline/vercel@0.26.1

@waline/vercel@0.26.2

@waline/vercel@0.26.3

@waline/vercel@0.26.4

@waline/vercel@0.26.5

@waline/vercel@0.26.6

@waline/vercel@0.26.7

@waline/vercel@0.26.8

@waline/vercel@0.26.9

@waline/vercel@0.3.0

@waline/vercel@0.4.0

@waline/vercel@0.5.0

@waline/vercel@0.5.1

@waline/vercel@0.5.2

@waline/vercel@0.5.3

@waline/vercel@0.5.4

@waline/vercel@0.5.5

@waline/vercel@0.6.0

@waline/vercel@0.7.0

@waline/vercel@0.7.1

@waline/vercel@0.7.2

@waline/vercel@0.8.0

@waline/vercel@0.8.1

@waline/vercel@0.8.2

@waline/vercel@0.8.3

@waline/vercel@0.8.4

@waline/vercel@0.8.5

@waline/vercel@0.8.6

@waline/vercel@0.8.7

@waline/vercel@0.9.0

@waline/vercel@1.*

@waline/vercel@1.0.0

@waline/vercel@1.1.0

@waline/vercel@1.1.1

@waline/vercel@1.1.2

@waline/vercel@1.10.0

@waline/vercel@1.10.1

@waline/vercel@1.11.0

@waline/vercel@1.12.0

@waline/vercel@1.13.0

@waline/vercel@1.13.1

@waline/vercel@1.13.2

@waline/vercel@1.13.3

@waline/vercel@1.13.4

@waline/vercel@1.13.5

@waline/vercel@1.13.6

@waline/vercel@1.14.0

@waline/vercel@1.15.0

@waline/vercel@1.15.1

@waline/vercel@1.15.2

@waline/vercel@1.15.3

@waline/vercel@1.16.0

@waline/vercel@1.17.0

@waline/vercel@1.17.1

@waline/vercel@1.17.2

@waline/vercel@1.17.3

@waline/vercel@1.17.4

@waline/vercel@1.18.0

@waline/vercel@1.18.1

@waline/vercel@1.18.2

@waline/vercel@1.18.3

@waline/vercel@1.18.4

@waline/vercel@1.18.5

@waline/vercel@1.18.6

@waline/vercel@1.18.7

@waline/vercel@1.18.8

@waline/vercel@1.18.9

@waline/vercel@1.19.0

@waline/vercel@1.19.1

@waline/vercel@1.19.2

@waline/vercel@1.19.3

@waline/vercel@1.19.4

@waline/vercel@1.2.0

@waline/vercel@1.2.1

@waline/vercel@1.2.2

@waline/vercel@1.2.3

@waline/vercel@1.2.4

@waline/vercel@1.2.5

@waline/vercel@1.2.6

@waline/vercel@1.20.0

@waline/vercel@1.20.1

@waline/vercel@1.21.0

@waline/vercel@1.22.0

@waline/vercel@1.23.0

@waline/vercel@1.23.1

@waline/vercel@1.23.2

@waline/vercel@1.23.3

@waline/vercel@1.23.4

@waline/vercel@1.23.5

@waline/vercel@1.24.0

@waline/vercel@1.24.1

@waline/vercel@1.25.0

@waline/vercel@1.25.1

@waline/vercel@1.25.2

@waline/vercel@1.26.0

@waline/vercel@1.26.1

@waline/vercel@1.26.2

@waline/vercel@1.26.3

@waline/vercel@1.26.3-deta

@waline/vercel@1.26.3-deta-alpha.0

@waline/vercel@1.26.4

@waline/vercel@1.26.5

@waline/vercel@1.27.0

@waline/vercel@1.27.1

@waline/vercel@1.28.0

@waline/vercel@1.28.0-alpha.0

@waline/vercel@1.28.0-alpha.1

@waline/vercel@1.28.0-alpha.2

@waline/vercel@1.28.1

@waline/vercel@1.28.2

@waline/vercel@1.29.0

@waline/vercel@1.3.0

@waline/vercel@1.3.1

@waline/vercel@1.3.2

@waline/vercel@1.30.0

@waline/vercel@1.30.1

@waline/vercel@1.30.2

@waline/vercel@1.30.3

@waline/vercel@1.30.4

@waline/vercel@1.30.5

@waline/vercel@1.31.0

@waline/vercel@1.31.1

@waline/vercel@1.31.10

@waline/vercel@1.31.11

@waline/vercel@1.31.12

@waline/vercel@1.31.2

@waline/vercel@1.31.3

@waline/vercel@1.31.4

@waline/vercel@1.31.9

@waline/vercel@1.36.1

@waline/vercel@1.4.0

@waline/vercel@1.4.1

@waline/vercel@1.40.0

@waline/vercel@1.40.1

@waline/vercel@1.5.0

@waline/vercel@1.5.1

@waline/vercel@1.6.0

@waline/vercel@1.6.1

@waline/vercel@1.7.0

@waline/vercel@1.8.0

@waline/vercel@1.8.1

@waline/vercel@1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64671.json"