Valine code injection vulnerability

CRITICAL 9.6CVE-2022-38545 · GHSA-mcvg-g9wx-v5vx · Published 19/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
valine valine.js	`= 1.4.18`	No fix yet
valine npm	`< 1.5.0`	`1.5.0`

Description

Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

NVD description

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2022-38545 · ADVISORY
xCss/Valine · WEB
xCss/Valine commit c40826c · WEB
xCss/Valine · PACKAGE
xCss/Valine release v1.5.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free