TI-2022-18133 Aliases CVE-2022-38545 GHSA-mcvg-g9wx-v5vx

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability…

HIGH 66CWE-79Published 2022-09-19 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

Why it matters now

EPSS 0.34128 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed valine (npm): 1.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	valine (npm)	before 1.5.0	1.5.0	Patch available	GHSA-mcvg-g9wx-v5vx

— Vendor— Affected all versions Fixed in — No fix listed CNA
valine (npm) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-mcvg-g9wx-v5vx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:valine.js:valine:1.4.18:::::::*	1.4.18	Vulnerable	Valine.js

cpe:2.3:a:valine.js:valine:1.4.18:*:*:*:*:*:*:* Versions 1.4.18 Vulnerable ·Valine.js

Remediation

Fix · GHSA-mcvg-g9wx-v5vx valine (npm) Fixed in 1.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-38545
2026-10-03 Alias added: GHSA-mcvg-g9wx-v5vx

References

Exploit 1

https://github.com/xCss/Valine/issues/400

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-38545

Other 3

TI-2018-13676 An issue was discovered in Valine v1.3.3. CVSS 3.1MEDIUM 6.1
TI-2021-13797 Valine 1.4.14 allows remote attackers to cause a denial of service (application outage)… CVSS 3.1MEDIUM 5.3
TI-2020-17409 Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences