Valine HTML Injection

Description

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

Recommendation

Update the valine package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.3.3
• Patched version(s): 1.3.4

References

• GHSA-hhrp-qm88-xjr3
• CVE-2018-19289
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902
• Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
• SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
• Valine code injection vulnerability - CVE-2022-38545

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

valine