Waline Comment System Stored XSS Vulnerability

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer, and the preview is injected with v-html.

When a comment is edited, the editor is seeded with the comment's raw, un-sanitized body. This leads to a stored XSS vulnerability.

• Affected versions: 3.15.2 and prior
• Precondition: Only administrators and the comment owner can edit comments
• Impact: An unauthenticated commenter can achieve privilege-escalation stored XSS against a moderator with a single Edit click

At time of publication, there are no publicly available patches.