CVE-2026-62345 in Wanderer
Summary
by MITRE • 11/06/2026
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in Wanderer, specifically affecting versions prior to 0.19.3, represents a significant cross-site scripting (XSS) flaw rooted in improper input validation and unsafe DOM manipulation within the application's trail mapping functionality. As a self-hosted platform designed for saving and sharing outdoor adventures, Wanderer relies heavily on user-generated content such as waypoints and trails. The core technical defect lies in how the frontend processes waypoint data when rendering map markers. Specifically, the function createMarkerFromWaypoint() accepts an icon value from a crafted waypoint object without sufficient sanitization or validation against a whitelist of safe values. This unvalidated input is subsequently passed to FontawesomeMarker, which then utilizes insertAdjacentHTML to inject the content directly into the DOM structure representing the map marker markup.
This architectural choice introduces a classic stored cross-site scripting vector because the malicious payload persists in the database as part of the waypoint data rather than being transiently injected via URL parameters or form fields during a single session. When another user views a trail containing this compromised waypoint, their browser parses the HTML content returned by the server and executes the embedded script within its own security context. The use of insertAdjacentHTML is particularly risky in this context because it allows for the insertion of arbitrary HTML elements that can contain executable JavaScript code blocks or event handlers such as onload or onerror attributes. This mechanism bypasses standard browser protections against inline scripts if Content Security Policy headers are not strictly configured to prevent script execution from dynamic content sources.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation within the federated ecosystem that many self-hosted instances participate in. While an authenticated local user can directly inject malicious payloads by creating or editing waypoints, the threat landscape expands significantly through federation protocols. Federated waypoint data allows information from other Wanderer instances to be pulled into a local instance without requiring any prior account creation on the receiving server. Consequently, if a remote instance hosts trails with compromised waypoints, users of an otherwise secure and isolated local instance can still trigger the XSS payload simply by viewing these federated maps. This means that even administrators who do not actively create content are vulnerable to attacks originating from external sources they may trust or automatically aggregate.
Exploitation of this flaw enables attackers to perform a variety of malicious actions against victims whose browsers execute the injected scripts. The most immediate risk is session hijacking, where the attacker's script extracts sensitive cookies, local storage tokens, or authentication headers associated with the victim's current browsing session. With these credentials in hand, an adversary can impersonate the user on the Wanderer instance, gaining unauthorized access to private trails, personal data, and administrative controls if the compromised account holds elevated privileges. Furthermore, attackers can manipulate the application interface by modifying DOM elements, redirecting users to phishing sites designed to steal further credentials or install malware, or defacing public trail maps with malicious content that damages the reputation of the instance administrators.
To mitigate this vulnerability, immediate action is required for all instances running versions earlier than 0.19.3. The primary remediation step is upgrading the Wanderer software to version 0.19.3 or later, where the developers have implemented proper sanitization and validation mechanisms to prevent arbitrary HTML injection through waypoint icons. In addition to updating the application, administrators should review their Content Security Policy (CSP) configurations to ensure that script-src directives do not allow unsafe-inline scripts unless absolutely necessary for legacy compatibility, thereby adding a layer of defense-in-depth against future XSS attempts. It is also advisable to audit existing federated data sources and consider temporarily disabling federation with untrusted instances until the upgrade is complete. Regular security assessments and code reviews focusing on DOM-based sinks like insertAdjacentHTML are recommended to maintain robust protection against similar injection flaws in web applications that handle rich user-generated content.