CVE-2026-62345

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.

• CWE-79

• https://github.com/open-wanderer/wanderer/commit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b
• https://github.com/open-wanderer/wanderer/pull/1093
• https://github.com/open-wanderer/wanderer/releases/tag/v0.19.3
• https://github.com/open-wanderer/wanderer/security/advisories/GHSA-hx3v-rv4v-w875

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62333OpenVM is a performant and modular zkVM framework built for …8.7
• CVE-2026-62334OpenVM is a performant and modular zkVM framework built for …8.7
• CVE-2026-62335OpenVM is a performant and modular zkVM framework built for …6.9
• CVE-2026-62337SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5…6.9
• CVE-2026-62343ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-62344Wanderer is a self-hosted trail database for saving and shar…7.5
• CVE-2026-62346Wanderer is a self-hosted trail database for saving and shar…7.6
• CVE-2026-62347Element Call is a native Matrix video conferencing applicati…5.9
• CVE-2026-62348TDengine is a time-series database optimized for Internet of…5.4
• CVE-2026-62349TDengine is an open source, time-series database optimized f…8.3
• CVE-2026-6235The Sendmachine for WordPress plugin for WordPress is vulner…9.8
• CVE-2026-62350TDengine is an open source, time-series database optimized f…7.2