CVE-2026-62345

Name of the Vulnerable Software and Affected Versions Wanderer versions prior to 0.19.3

Description An authenticated user can store a crafted waypoint.icon value. The createMarkerFromWaypoint() function passes this value into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated data into the map marker markup. When a user opens the affected trail map, an attacker-controlled script executes in the browser, potentially exposing session tokens or performing actions on behalf of the victim. This issue can also be triggered by federated waypoint data without requiring a local account on the receiving instance.

Recommendations Update to version 0.19.3.