CVE-2026-62346

Wanderer is a self-hosted trail database for saving and sharing adventures.

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated…

6. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-62346