# CVE-2026-62345: Wanderer stored cross-site scripting in waypoint icon

Source: https://junglewise.ai/threats/cve-2026-62345-wanderer-is-a-self-hosted-trail-database-for-saving-and-sharing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-62345 · Severity: high · CVSS 7.6 · Published 2026-11-06

Wanderer is a self-hosted trail database for recording and sharing outdoor adventures. An authenticated user can craft a malicious waypoint icon value that executes JavaScript when another user views the affected trail map, potentially exposing session tokens or allowing the attacker to perform actions as the victim. Waypoint data can also reach this vulnerability when federated between instances without requiring a local account.

Technologies: [Open-Wanderer Wanderer](https://junglewise.ai/threats/technologies/wanderer). Vendors: [Open-Wanderer](https://junglewise.ai/threats/vendors/open-wanderer).

## Quick answers

**Is CVE-2026-62345 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62345 being exploited in the wild.

**How severe is CVE-2026-62345?** High severity, with a CVSS score of 7.6, published 6 November 2026.

**Which products and versions are affected?** Open-Wanderer Wanderer before 0.19.3.

**Is there a fix for CVE-2026-62345?** Yes: fixed in 0.19.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62345 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62345?** Check whether you run Open-Wanderer Wanderer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.19.3

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the createMarkerFromWaypoint() function, which passes an unvalidated waypoint.icon value to FontawesomeMarker using insertAdjacentHTML, allowing arbitrary HTML and script injection. An authenticated attacker can store a crafted waypoint.icon payload that executes in the browser of any user viewing the map. The vulnerability also affects federated waypoint data, which can reach the vulnerable code path without the receiving instance requiring authentication.

## Affected products

- Open Wanderer Wanderer before 0.19.3

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b](https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b)
- [https://github.com/open-wanderer/wanderer/pull/1093](https://github.com/open-wanderer/wanderer/pull/1093)

## Related threats

- [Wanderer SSRF in trail download endpoint](https://junglewise.ai/threats/cve-2026-71495-wanderer-is-a-self-hosted-trail-database-for-saving-and-sharing)
- [Wanderer stored XSS in elevation profile via waypoint data](https://junglewise.ai/threats/cve-2026-62346-wanderer-is-a-self-hosted-trail-database-for-saving-and-sharing)
- [Wanderer information disclosure via unauthenticated ActivityPub endpoints](https://junglewise.ai/threats/cve-2026-62344-wanderer-is-a-self-hosted-trail-database-for-saving-and-sharing)