{"affected":[{"product":"waline","source":"CNA: GitHub_M","vendor":"walinejs","versions":[{"status":"affected","version":"<= 3.15.2"}]}],"cveId":"CVE-2026-64670","cwes":["CWE-79","CWE-116"],"description":"Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body (orig). Only administrators and the comment owner can edit. So an administrator who clicks Edit on an attacker's comment renders that attacker's raw HTML in their own session: an unauthenticated commenter achieves privilege-escalation stored XSS against a moderator with a single Edit click. At time of publication, there are no publicly available patches.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794368542276,"publishedAt":1794368542276,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/walinejs/waline/security/advisories/GHSA-crj3-q72p-ggqm"}],"remediation":[],"revision":"2b54a554fde76c007cf7dd739127021d29b504903a7db89adad078319693d1ac","sources":[{"modifiedAt":1794368542276,"name":"CNA: GitHub_M","retrievedAt":1794370179953,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64670"}],"ssvc":null,"status":"published","title":"Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit","updatedAt":1794370179953}