TI-2018-13676 Aliases CVE-2018-19289 GHSA-hhrp-qm88-xjr3

An issue was discovered in Valine v1.3.3.

LOW 30CWE-79Published 2018-11-15 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.

Why it matters now

EPSS 0.01228 69th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed valine (npm): 1.3.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	valine (npm)	before 1.3.4	1.3.4	Patch available	GHSA-hhrp-qm88-xjr3

— Vendor— Affected all versions Fixed in — No fix listed CNA
valine (npm) Vendor— Affected before 1.3.4 Fixed in 1.3.4 Patch available GHSA-hhrp-qm88-xjr3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:valine.js:valine:1.3.3:::::::*	1.3.3	Vulnerable	Valine.js

cpe:2.3:a:valine.js:valine:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Valine.js

Remediation

Fix · GHSA-hhrp-qm88-xjr3 valine (npm) Fixed in 1.3.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-19289
2026-10-03 Alias added: GHSA-hhrp-qm88-xjr3

References

Exploit 1

https://github.com/xCss/Valine/issues/127

Advisory 2

Other 2

TI-2022-18133 Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability… CVSS 3.1CRITICAL 9.6
TI-2021-13797 Valine 1.4.14 allows remote attackers to cause a denial of service (application outage)… CVSS 3.1MEDIUM 5.3
TI-2020-17409 Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences