{"id":"CVE-2026-62345","aliases":["EUVD-2026-118396","GHSA-hx3v-rv4v-w875"],"status":"published","title":"Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00261,"percentile":0.18009,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-06T18:03:09Z","modified":"2026-11-07T02:48:46Z","products":[{"vendor":"open-wanderer","product":"wanderer"}],"references":[{"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/open-wanderer/wanderer/pull/1093","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62345.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62345","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-62345","title":"Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","status":"published","published":"2026-11-06T18:03:09.599Z","modified":"2026-11-09T22:44:31.966Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-09T23:35:22.059445Z"}],"euvd":[{"id":"EUVD-2026-118396","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","status":"published","published":"2026-11-06T18:03:09Z","modified":"2026-11-09T22:44:31Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-10T00:18:43.414497Z"}],"nvd":[{"id":"CVE-2026-62345","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","status":"published","published":"2026-11-06T19:17:53.607Z","modified":"2026-11-12T22:18:51.47Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T22:02:17.053381Z"}],"osv":[{"id":"CVE-2026-62345","title":"Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","status":"published","published":"2026-11-06T18:03:09.599Z","modified":"2026-11-14T02:30:26.942981623Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-08T03:29:52.421856Z"}]}}