CVE-2026-64671: Stored XSS in the @waline/client UserList widget via an unescaped commenter link field
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by the server (only the comment body is sanitized), and the link field is never sent to the spam filter. So an unauthenticated visitor who posts a comment with link = x"><img src=x onerror=...> achieves stored cross-site scripting that executes, with no interaction, in the browser of every visitor to a page that embeds the UserList widget. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using @waline/client version 3.15.2 or earlier that embed the UserList widget are exposed. Any visitor who loads a page containing that widget can have attacker-controlled script execute in their browser.
What does an attacker need to exploit it?
An attacker only needs to submit a comment with a crafted commenter link value. No authentication or victim interaction is required; the malicious value is stored by the server and rendered by the UserList widget.
Are default protections sufficient to prevent exploitation?
No. The commenter link is returned verbatim and is not sent to the spam filter, while the UserList widget inserts it into the page without HTML escaping. Sanitization of comment bodies does not protect this field.
What can be done while no patch is available?
Remove or disable the UserList widget on affected pages until a patch is available. Also identify and remove or correct existing commenter link values that contain HTML or script-like payloads, since stored entries may continue to affect visitors.
How can I determine whether my site has already been targeted?
Review stored Waline commenter link fields for unexpected HTML markup or payloads such as quote characters, tags, event handlers, or image elements. Check whether affected pages embed the @waline/client UserList widget, because those stored values are only executed when the widget renders them.