CVE-2026-62346

Name of the Vulnerable Software and Affected Versions Wanderer versions prior to 0.19.3

Description An issue exists where an authenticated local user can submit crafted waypoint.name and waypoint.icon values. These values are interpolated into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. This allows a victim viewing the elevation profile to execute an attacker-controlled script in their browser, which can expose session data or perform actions in the victim's context. Additionally, federated waypoints can deliver these malicious fields across instances, removing the requirement for the attacker to have a local account on the receiving instance.

Recommendations Update to version 0.19.3.