CVE-2026-62345: fallo de gravedad alta en open-wanderer wanderer
Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
18Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.6
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Productos afectados
open-wanderer · wandererCVEs relacionadas — open-wanderer wanderer
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-71495CRITICALWanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network AccessEPSS —CVE-2026-62346HIGHWanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTMLEPSS —CVE-2026-62344HIGHWanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub EndpointsEPSS —