# CVE-2022-38545: Valine code injection vulnerability

Source: https://junglewise.ai/threats/cve-2022-38545-valine-code-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-38545 · Severity: low · CVSS 3.1 · Published 2022-09-20

Valine is a popular comment system library used on websites to manage user comments. An attacker can inject and execute arbitrary code through a specially crafted request, potentially compromising the website and stealing user data or taking over the site.

Technologies: [valine (npm)](https://junglewise.ai/threats/technologies/valine). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-38545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-38545 being exploited in the wild.

**How severe is CVE-2022-38545?** Low severity, with a CVSS score of 3.1, published 20 September 2022.

**Which products and versions are affected?** valine (npm) SEMVER:introduced=0,fixed=1.5.0.

**Is there a fix for CVE-2022-38545?** Yes. valine (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-38545 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-38545?** Check whether you run valine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- valine (npm): upgrade to 1.5.0 or later

  ```sh
  npm install valine@1.5.0
  ```


## Technical details

Valine contains a code injection vulnerability (CWE-74, CWE-79) that allows remote code execution through a crafted POST request. The vulnerability stems from insufficient input sanitization of user-supplied data, particularly in the user-agent field of comments, which can be manipulated to execute arbitrary code. An attacker requires network access to the affected Valine instance but no authentication; user interaction may be required depending on deployment context. The vulnerability affects all versions prior to 1.5.0, which includes the fix. The vulnerability was publicly disclosed in June 2022 with patches available since then.

## Affected products

- Valine Valine All versions prior to 1.5.0

## Identifiers

- CVE-2022-38545
- GHSA-mcvg-g9wx-v5vx

## Timeline

- 2022-06-21: disclosed: Issue reported on GitHub
- 2022-09-20: advisory: GHSA advisory published
- 2022-09-20: patched: Fix released in version 1.5.0

## References

- [https://github.com/xCss/Valine/issues/400](https://github.com/xCss/Valine/issues/400)

## Related threats

- [Valine stored cross-site scripting in nick parameter](https://junglewise.ai/threats/cve-2020-28847-valine-stored-cross-site-scripting-in-nick-parameter)
- [Valine denial of service via malformed User-Agent](https://junglewise.ai/threats/cve-2021-34801-valine-denial-of-service-via-malformed-user-agent)
- [Valine HTML injection via embedded PDF files](https://junglewise.ai/threats/cve-2018-19289-valine-html-injection-via-embedded-pdf-files)