Script Injection Vulnerability in Wanderer Database Affects Users' Security
CVE-2026-62345

7.6HIGH

Key Information:

Vendor: Open-wanderer
Status: Wanderer
Vendor: CVE Published:; 6 November 2026

🔔 Create Open-wanderer Vulnerability Alert

What is CVE-2026-62345?

A security concern exists in Wanderer, a self-hosted trail database, where an authenticated user may exploit the system by inserting a malicious waypoint.icon value. This can lead to the execution of attacker-controlled scripts in a viewer's browser through the createMarkerFromWaypoint() function, which is integrated into the FontawesomeMarker. Consequently, this can enable attackers to reveal session tokens or execute actions on behalf of the victim user. Additionally, the vulnerability is capable of affecting federated waypoint data, even without a local account on the target instance. The issue has been rectified in version 0.19.3.