Reflected XSS Vulnerability in Valhalla Routing Engine

CVE-2026-49294

What is CVE-2026-49294?

Valhalla, an open source routing engine used with OpenStreetMap data, is vulnerable to reflected cross-site scripting (XSS) due to improper handling of user input in the JSONP callback parameter. In versions 3.6.3 and earlier, an attacker can exploit this flaw by crafting a URL that includes malicious JavaScript. When a victim loads this URL, the injected script executes in the context of the user's session, leading to potential session token theft or unauthorized actions performed on their behalf. The vulnerability remains unpatched as of the time of this publication, highlighting the urgency for users to assess their exposure and implement mitigations.

References