CVE-2026-62346 in Wanderer
Summary
by MITRE • 11/06/2026
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim's context. This issue is fixed in version 0.19.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as Wanderer prior to version 0.19.3 represents a critical cross-site scripting flaw rooted in improper input validation and output encoding within the application’s trail elevation graph feature. As a self-hosted platform designed for saving and sharing outdoor adventures, Wanderer relies on user-generated content such as waypoints to populate interactive visualizations. The core technical deficiency lies in the handling of specific waypoint attributes, namely name and icon fields, which are processed by an innerHTML template located within the maplibre-elevation-profile module. When a local authenticated user submits crafted values for these fields, the application fails to apply HTML encoding or perform adequate validation on the input data before rendering it into the DOM. This lack of sanitization allows malicious script payloads embedded in the waypoint metadata to be interpreted and executed directly by the browser when another user views the corresponding elevation profile.
From a technical perspective, this vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The attack vector exploits the trust relationship between the application’s rendering engine and its users by leveraging the innerHTML property to inject executable JavaScript code rather than static text content. Because the elevation profile is a dynamic component that frequently updates based on user interaction, it serves as an effective delivery mechanism for persistent stored cross-site scripting attacks. An attacker who has established a local account can create waypoints with maliciously crafted name or icon values containing script tags or event handlers such as onload attributes. These payloads are then stored in the database and subsequently rendered to any other user accessing that specific trail data, resulting in arbitrary code execution within the victim’s browser context without requiring further interaction beyond viewing the profile.
The operational impact of this vulnerability is significant due to its potential for session hijacking and unauthorized actions performed on behalf of the victim. Since the injected script executes with the same privileges as legitimate application scripts, it can access sensitive session cookies, local storage data, or authentication tokens associated with the user’s current browsing context. This capability allows an attacker to steal active sessions, impersonate victims, or perform state-changing operations such as modifying trail data, deleting waypoints, or exfiltrating personal information stored locally by the web application. Furthermore, the vulnerability extends beyond isolated instances through federated waypoint sharing mechanisms. Federated systems allow users on one instance to view and interact with content from other connected Wanderer servers. This feature enables attackers to deliver malicious payloads across organizational boundaries without needing a local account on every target instance, thereby amplifying the scope of potential compromise and facilitating broader impact across the federation network.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which refers to JavaScript execution within web browsers as part of lateral movement or data exfiltration phases in an attack chain. The ability to execute arbitrary code via stored XSS provides a persistent foothold that can be leveraged for subsequent exploitation steps such as credential harvesting or pivoting into internal networks if the application is integrated with other services. To mitigate this risk, it is imperative to implement strict output encoding whenever user-supplied data is rendered into HTML contexts using innerHTML or similar DOM manipulation methods. Developers should adopt a whitelist approach for allowed characters in fields like waypoint names and icons, ensuring that only alphanumeric characters and safe symbols are permitted while stripping out any potentially executable content such as script tags, event handlers, or protocol schemes. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed within the application environment.
The resolution for this issue was released in version 0.19.3 of the Wanderer software. Administrators operating self-hosted instances must upgrade to this patched version immediately to eliminate the vulnerability. For environments utilizing federated waypoint sharing, it is also recommended to audit existing data for any previously injected malicious payloads that may have been stored prior to the patch application. Regular security assessments and code reviews focusing on input validation and output encoding practices should be integrated into the development lifecycle to prevent similar vulnerabilities from arising in future releases. By addressing these fundamental web security principles, organizations can maintain the integrity of their trail databases and protect users from unauthorized access and data compromise through cross-site scripting attacks.