{"affected":[{"product":"wanderer","source":"CNA: GitHub_M","vendor":"open-wanderer","versions":[{"status":"affected","version":"< 0.19.3"}]}],"cveId":"CVE-2026-62345","cwes":["CWE-79"],"description":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.","epss":{"date":"2026-11-09","percentile":0.17937,"score":0.00261},"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},{"score":7.6,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"}],"modifiedAt":1794266244200,"publishedAt":1793988189599,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/pull/1093"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/open-wanderer/wanderer/pull/1093"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875"}],"remediation":[],"revision":"ea9a32412832203771689369e21af82a6b8160735c4e71c30cb47ed0fd89aa3f","sources":[{"modifiedAt":1794264271966,"name":"CNA: GitHub_M","retrievedAt":1794265822065,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62345"},{"modifiedAt":1794266244200,"name":"NVD","retrievedAt":1794269918705,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62345"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794265822358,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62345"}],"ssvc":{"assessedAt":1794263699830,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)","updatedAt":1794269918705}