{"id":"CVE-2026-62345","kind":"vulnerability","aliases":["CVE-2026-62345"],"related":[],"title":"Wanderer: crafted waypoint icon runs script in trail map viewers","description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","summary":"Wanderer, a self-hosted trail database, inserts an unvalidated waypoint icon value into map marker HTML. Opening an affected trail map runs attacker-controlled script in the viewer's browser, which can expose session tokens or act as the victim.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["federation","other","self-hosted","wanderer"],"not_affected_if":["fixed-in-0.19.3"],"how_to_check":"- Check the running Wanderer version; instances below `0.19.3` are affected.\n- Federated waypoint data can reach the sink, so instances that accept federated content are also in scope.","fix":"- Wanderer: upgrade to `0.19.3`.","status":"open","published_at":"2026-11-06T19:17:53+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","triaged_at":"2026-11-06T19:45:57+00:00","updated_at":"2026-11-06T19:45:57+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-06T19:45:57Z","model":"claude-haiku-5-5","output":{"fix":"- Wanderer: upgrade to `0.19.3`.","reach":"internet","title":"Wanderer: crafted waypoint icon runs script in trail map viewers","impact":"high","summary":"Wanderer, a self-hosted trail database, inserts an unvalidated waypoint icon value into map marker HTML. Opening an affected trail map runs attacker-controlled script in the viewer's browser, which can expose session tokens or act as the victim.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wanderer","self-hosted","federation"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in viewer browsers, exposing session tokens","analyst_note":"","how_to_check":"- Check the running Wanderer version; instances below `0.19.3` are affected.\n- Federated waypoint data can reach the sink, so instances that accept federated content are also in scope.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-in-0.19.3"],"who_is_affected":"Any Wanderer instance before 0.19.3 that displays trail maps with waypoints is exposed. Authenticated users can plant the payload directly, and federated waypoint data can deliver it to a receiving instance without a local account. Instances already on 0.19.3 or later are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001168,"input_tokens":4355,"output_tokens":1465,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62345':13A,16A '0.19.3':80C,153C 'account':142C 'act':61B 'action':127C 'adventur':77C 'affect':42B,107C 'also':135C 'attack':47B,112C 'attacker-control':46B,111C 'authent':82C 'browser':54B,119C 'control':48B,113C 'craft':2A,87C 'createmarkerfromwaypoint':91C 'cve':11A,14A 'data':133C 'databas':29B,72C 'execut':110C 'expos':57B,122C 'feder':17B,131C 'fix':150C 'fontawesomemark':94C 'host':21B,27B,70C 'html':39B 'icon':4A,34B 'insert':30B,97C 'insertadjacenthtml':96C 'instanc':146C 'issu':148C 'local':141C 'map':9A,37B,44B,102C,109C 'marker':38B,103C 'markup':104C 'open':40B,105C 'pass':92C 'perform':126C 'prior':78C 'reach':136C 'receiv':145C 'run':5A,45B 'save':74C 'script':6A,49B,114C 'self':20B,26B,69C 'self-host':19B,25B,68C 'session':58B,123C 'share':76C 'sink':138C 'store':85C 'token':59B,124C 'trail':8A,28B,43B,71C,108C 'unvalid':32B,99C 'user':83C 'valu':35B,89C,100C 'version':152C 'victim':64B,130C 'viewer':10A,52B,117C 'wander':1A,22B,23B,65C 'waypoint':3A,33B,132C 'waypoint.icon':88C 'without':139C","nicknames":[],"mitigations":[],"who_affected":"Any Wanderer instance before 0.19.3 that displays trail maps with waypoints is exposed. Authenticated users can plant the payload directly, and federated waypoint data can deliver it to a receiving instance without a local account. Instances already on 0.19.3 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["federation","high","other","selfhosted","wanderer"],"campaign_type":null,"search_a":"'-2026':12A,15A '-62345':13A,16A 'craft':2A 'cve':11A,14A 'icon':4A 'map':9A 'run':5A 'script':6A 'trail':8A 'viewer':10A 'wander':1A 'waypoint':3A","search_b":"'act':61B 'affect':42B 'attack':47B 'attacker-control':46B 'browser':54B 'control':48B 'databas':29B 'expos':57B 'feder':17B 'host':21B,27B 'html':39B 'icon':34B 'insert':30B 'map':37B,44B 'marker':38B 'open':40B 'run':45B 'script':49B 'self':20B,26B 'self-host':19B,25B 'session':58B 'token':59B 'trail':28B,43B 'unvalid':32B 'valu':35B 'victim':64B 'viewer':52B 'wander':22B,23B 'waypoint':33B","search_c":"'0.19.3':80C,153C 'account':142C 'action':127C 'adventur':77C 'affect':107C 'also':135C 'attack':112C 'attacker-control':111C 'authent':82C 'browser':119C 'control':113C 'craft':87C 'createmarkerfromwaypoint':91C 'data':133C 'databas':72C 'execut':110C 'expos':122C 'feder':131C 'fix':150C 'fontawesomemark':94C 'host':70C 'insert':97C 'insertadjacenthtml':96C 'instanc':146C 'issu':148C 'local':141C 'map':102C,109C 'marker':103C 'markup':104C 'open':105C 'pass':92C 'perform':126C 'prior':78C 'reach':136C 'receiv':145C 'save':74C 'script':114C 'self':69C 'self-host':68C 'session':123C 'share':76C 'sink':138C 'store':85C 'token':124C 'trail':71C,108C 'unvalid':99C 'user':83C 'valu':89C,100C 'version':152C 'victim':130C 'viewer':117C 'wander':65C 'waypoint':132C 'waypoint.icon':88C 'without':139C","first_public_at":"2026-07-02T13:02:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62345","severity":null,"published_at":"2026-11-06T19:17:53+00:00","modified_at":"2026-11-06T19:17:53+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[{"id":88847,"url":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88848,"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":89354,"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T13:02:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}