GHSA-m7v2-6gj3-3g2p: Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim's context. This issue is fixed in version 0.19.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wandererto a version that resolves this vulnerability.Fixed in 0.19.3
Event History
Frequently Asked Questions
Who can introduce malicious waypoint data?
Before 0.19.3, an authenticated local user can submit crafted waypoint.name or waypoint.icon values. Malicious waypoint fields can also arrive through federation from another instance, without the attacker needing a local account on the receiving instance.
When does the payload execute?
The payload executes in a victim's browser when they view the affected trail elevation profile. The vulnerable elevation graph inserts the waypoint fields into an innerHTML template without HTML encoding or icon validation.
Are instances that do not allow untrusted local registrations still exposed?
They may still be exposed if they receive federated waypoints, because the issue can be delivered across instances by an attacker without an account on the receiving instance. The provided information does not identify other configuration-based mitigations.
What should be done if an instance may be affected?
Upgrade to Wanderer 0.19.3, which fixes the issue. Until upgrading, treat viewing elevation profiles containing untrusted or federated waypoint data as potentially unsafe.