Wanderer exposes private trails and runs injected scripts in browsers

Summary

Wanderer is a self-hosted trail database for saving and sharing adventures. Before 0.19.3, anyone without a login can view private trails and comments, and malicious scripts can run in other users' browsers.

What to do

Update to 0.19.3 or later.

Products and platforms

• Wanderer

CVE IDs

• CVE-2026-62344 (opens in a new tab)
• CVE-2026-62345 (opens in a new tab)
• CVE-2026-62346 (opens in a new tab)

Sources

• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-06 17:55 UTC

First seen 2026-11-09 18:30 UTC