CVE-2026-49294: Valhalla has reflected XSS via unsanitized JSONP callback parameter
Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting (XSS) due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the HTTP response body with Content-Type: application/javascript, without any validation, output encoding, or allowlist filtering. An attacker can craft a URL containing arbitrary JavaScript in the callback parameter; if a victim is induced to load that URL via a <script src="..."> tag, the injected script executes in the context of the serving origin, potentially leading to session token theft, credential disclosure, or actions performed on behalf of the victim. This issue was not fixed at time of publication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable JSONP/callback support so the service does not reflect the callback parameter into application/javascript responses.
Valhalla JSONP/callback handling = disabled - Configuration
If JSONP support is required, validate the callback parameter against a strict allowlist or safe identifier regex and apply proper output encoding/escaping before reflecting it into responses; do not directly reflect arbitrary input.
Valhalla JSONP callback validation and output encoding = apply allowlist/strict validation and proper output encoding - Compensating control
Deploy WAF or reverse-proxy rules to block or strip requests containing a JSONP 'callback' parameter (or to block responses that reflect unvalidated callback values) and restrict embedding of scripts from the service to trusted origins.
- Operational
If a vulnerable Valhalla instance may have been accessed, assume possible compromise: rotate session tokens and credentials, invalidate active sessions/cookies, and review logs for requests containing callback parameters for signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49294?
CVE-2026-49294 has a medium severity rating of 6.1.
How do I fix CVE-2026-49294?
To fix CVE-2026-49294, update Valhalla to version 3.6.4 or later where the vulnerability is addressed.
What type of vulnerability is CVE-2026-49294?
CVE-2026-49294 is classified as a reflected cross-site scripting (XSS) vulnerability.
Which versions of Valhalla are affected by CVE-2026-49294?
Valhalla versions 3.6.3 and prior are affected by CVE-2026-49294.
What causes the vulnerability in CVE-2026-49294?
CVE-2026-49294 is caused by improper neutralization of input in the JSONP callback parameter.