CVE-2026-62345: high-severity vulnerability in open-wanderer wanderer
Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected products
open-wanderer · wandererRelated CVEs — open-wanderer wanderer
In the same product, most dangerous first.
CVE-2026-71495CRITICALWanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network AccessEPSS —CVE-2026-62346HIGHWanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTMLEPSS —CVE-2026-62344HIGHWanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub EndpointsEPSS —