Executive brief
Valine is a popular comment system library used on websites to manage user comments. An attacker can inject and execute arbitrary code through a specially crafted request, potentially compromising the website and stealing user data or taking over the site.
Technical details
Valine contains a code injection vulnerability (CWE-74, CWE-79) that allows remote code execution through a crafted POST request. The vulnerability stems from insufficient input sanitization of user-supplied data, particularly in the user-agent field of comments, which can be manipulated to execute arbitrary code. An attacker requires network access to the affected Valine instance but no authentication; user interaction may be required depending on deployment context. The vulnerability affects all versions prior to 1.5.0, which includes the fix. The vulnerability was publicly disclosed in June 2022 with patches available since then.
Affected products
- Valine Valine All versions prior to 1.5.0
Timeline
- 2022-06-21: disclosed: Issue reported on GitHub
- 2022-09-20: advisory: GHSA advisory published
- 2022-09-20: patched: Fix released in version 1.5.0