CVE-2026-62346

The Wanderer self-hosted trail database (prior to version 0.19.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . An authenticated local user can submit malicious waypoint.name and waypoint.icon values which are interpolated into an innerHTML template in web/src/lib/vendor/maplibre-elevatio...

EUVD-2026-118397

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in...

EUVD-2026-118396

Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint passes into FontawesomeMarker, where insertAdjacentHTML inserts the unvalidated value into map marker markup...

CVE-2026-62345

The Wanderer self-hosted trail database is vulnerable to Stored XSS in versions prior to 0.19.3 . An authenticated user can provide a crafted waypoint.icon value which is then passed into createMarkerFromWaypoint() and subsequently injected into the map marker markup via insertAdjacentHTML withou...