An authenticated user can store a crafted `waypoint.icon` value. The `createMarkerFromWaypoint()` function passes this value into `FontawesomeMarker`, where `insertAdjacentHTML` inserts the unvalidated data into the map marker markup. When a user opens the affected trail map, an attacker-controlled script executes in the browser, potentially exposing session tokens or performing actions on behalf of the victim. This issue can also be triggered by federated waypoint data without requiring a local account on the receiving instance.