Description
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Recommendation
Update the valine package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.3.3
- Patched version(s): 1.3.4
References
Could your website be exposed too?
SmartScanner can check your website for Valine HTML Injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- Valine code injection vulnerability - CVE-2022-38545
You might also like:
See something that needs correcting? Let us knowUpdated September 07, 2023