{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-62345","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-13T21:42:50.095Z","datePublished":"2026-11-06T18:03:09.599Z","dateUpdated":"2026-11-06T18:03:09.599Z"},"containers":{"cna":{"title":"Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)","problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"}}],"references":[{"name":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875"},{"name":"https://github.com/open-wanderer/wanderer/pull/1093","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/pull/1093"},{"name":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b"},{"name":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3","tags":["x_refsource_MISC"],"url":"https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3"}],"affected":[{"vendor":"open-wanderer","product":"wanderer","versions":[{"version":"< 0.19.3","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-06T18:03:09.599Z"},"descriptions":[{"lang":"en","value":"Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3."}],"source":{"advisory":"GHSA-hx3v-rv4v-w875","discovery":"UNKNOWN"}}}}