Executive brief
Valhalla is an open-source routing engine used to process map data and provide directions. A security flaw allows attackers to inject malicious scripts into the engine's responses by manipulating a specific web request parameter. If a user clicks a malicious link or visits a compromised site, an attacker could steal their session information or perform unauthorized actions on their behalf within the application.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Valhalla's routing engine due to improper neutralization of the 'jsonp' parameter in 'src/worker.cc'. When a request includes a JSONP callback, the value is stored via 'options.set_jsonp()' and reflected directly into the HTTP response body with a 'Content-Type' of 'application/javascript'. Because the engine performs no validation, output encoding, or allowlist filtering on this parameter, an attacker can inject arbitrary JavaScript. If a victim's browser loads a crafted URL via a script tag, the malicious code executes in the context of the serving origin. As of the advisory publication, no official patch has been released, though a regex-based validation fix has been suggested.
Affected products
- Valhalla Valhalla <= 3.6.3
Timeline
- 2026-05-25: advisory: GitHub Security Advisory published
- 2026-06-15: disclosed: CVE published to NVD