Read the docs
TI-2026-86057 Aliases CVE-2026-62345

Stored XSS via waypoint icon in Wanderer map markers

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Wanderer, a self-hosted trail database, is affected before 0.19.3. An authenticated user can store a crafted waypoint.icon value that is inserted unvalidated into map marker markup through insertAdjacentHTML, a flaw classified as CWE-79. Opening the affected trail map runs attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach this sink without a local account on the receiving instance.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.

Why it matters now

EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed wanderer (open-wanderer): 0.19.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-wandererwandererbefore 0.19.30.19.3Patch availableCNA
  • wanderer Vendoropen-wanderer Affected before 0.19.3 Fixed in 0.19.3 Patch available CNA

Remediation

Update open-wanderer wanderer to version 0.19.3, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wanderer (open-wanderer) Fixed in 0.19.3

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-62345
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-86059 Server-side request forgery in Wanderer trail download endpoint CVSS 3.1CRITICAL 10.0
  • TI-2026-86058 Stored XSS in Wanderer elevation profile via waypoint name and icon CVSS 3.1HIGH 7.6
  • TI-2026-86052 Wanderer ActivityPub endpoints expose private trails and comments CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences