Read the docs
TI-2026-86058 Aliases CVE-2026-62346

Stored XSS in Wanderer elevation profile via waypoint name and icon

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Wanderer, a self-hosted trail database, is affected before 0.19.3. Waypoint name and icon values are inserted into an innerHTML template in the elevation profile without HTML encoding or icon validation, a cross-site scripting flaw (CWE-79). An authenticated local user can submit crafted waypoint values, and a victim who views the elevation profile runs the attacker's script in their browser. Federated waypoints can deliver the same fields across instances without a local account on the receiving instance, and the script can expose session data or perform actions as the victim.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim's context. This issue is fixed in version 0.19.3.

Why it matters now

EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed wanderer (open-wanderer): 0.19.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-wandererwandererbefore 0.19.30.19.3Patch availableCNA
  • wanderer Vendoropen-wanderer Affected before 0.19.3 Fixed in 0.19.3 Patch available CNA

Remediation

Upgrade open-wanderer Wanderer to version 0.19.3, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA wanderer (open-wanderer) Fixed in 0.19.3

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-62346
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-86059 Server-side request forgery in Wanderer trail download endpoint CVSS 3.1CRITICAL 10.0
  • TI-2026-86057 Stored XSS via waypoint icon in Wanderer map markers CVSS 3.1HIGH 7.6
  • TI-2026-86052 Wanderer ActivityPub endpoints expose private trails and comments CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences