Junglewise Threat Intelligence

CVE-2026-49294: Valhalla reflected XSS in JSONP callback parameter

CVE-2026-49294 · Severity: medium · CVSS 6.1 · Published 2026-06-15

Executive brief

Valhalla is an open-source routing engine used to process map data and provide directions. A security flaw allows attackers to inject malicious scripts into the engine's responses by manipulating a specific web request parameter. If a user clicks a malicious link or visits a compromised site, an attacker could steal their session information or perform unauthorized actions on their behalf within the application.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Valhalla's routing engine due to improper neutralization of the 'jsonp' parameter in 'src/worker.cc'. When a request includes a JSONP callback, the value is stored via 'options.set_jsonp()' and reflected directly into the HTTP response body with a 'Content-Type' of 'application/javascript'. Because the engine performs no validation, output encoding, or allowlist filtering on this parameter, an attacker can inject arbitrary JavaScript. If a victim's browser loads a crafted URL via a script tag, the malicious code executes in the context of the serving origin. As of the advisory publication, no official patch has been released, though a regex-based validation fix has been suggested.

Affected products

  • Valhalla Valhalla <= 3.6.3

Timeline

  • 2026-05-25: advisory: GitHub Security Advisory published
  • 2026-06-15: disclosed: CVE published to NVD

References

Related threats