CVE-2026-64670

Summary

Waline comment system versions 3.15.2 and prior contain a stored XSS vulnerability where untrusted HTML in a commenter's body is rendered unsanitized in an administrator's live preview when editing the comment, enabling privilege escalation via social engineering.

Exploitability

Exploitation requires an attacker to post a malicious comment and trick an administrator or comment owner into clicking 'Edit' on that comment; no authentication bypass is needed beyond initial comment submission.

Blast radius

Successful exploitation allows attackers to execute arbitrary scripts in the context of privileged moderators, potentially enabling session hijacking, data theft, or further compromise of the moderation interface.

Detection

Monitor server logs for HTTP requests where an administrator accesses the comment-edit endpoint (e.g., /api/comment/edit) with a comment ID containing known malicious HTML/JS patterns in the orig parameter; also inspect browser console errors or DOM manipulation events in admin sessions during preview rendering.

Prioritized remediation

Upgrade to a version that sanitizes Markdown content before rendering in the live preview (e.g., apply a DOMPurify-based sanitizer to the marked output); as no fixed version is published at time of publication, temporarily disable comment editing functionality or restrict edit access to trusted roles only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.