Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup. Opening the affected trail map executes attacker-controlled script in the viewer's browser, which can expose session tokens or perform actions as the victim. Federated waypoint data can also reach the sink without a local account on the receiving instance. This issue is fixed in version 0.19.3.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…nderer/security/advisories/GHSA-hx3v-rv4v-w875 Diğer
• github.com/open-wanderer/wanderer/pull/1093 Diğer
• github.com/…ommit/6135332ea69a3d9a4fe1dec5af1cb1ee74f70e2b Diğer
• github.com/open-wanderer/wanderer/releases/tag/v0.19.3 Diğer

Kayıt geçmişi

1. 6 Kas 2026 21:03Yayımlandı

İlgili açıklar

• 10,0 CVE-2026-71495Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
• 7,6 CVE-2026-62346Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML
• 7,5 CVE-2026-62344Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints
• 8,8 CVE-2026-118670OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
• 7,5 CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job details
• 5,4 CVE-2026-106143Cross-Site Scripting in Progress Software Kendo UI for Vue