wanderer

v0.19.3 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 24d Media Servers

✓ No known CVEs patched

This release patches 3 known CVEs

Topics

geography gps meilisearch pocketbase self-hosted sveltekit

Affected surfaces

auth rce_ssrf

Summary

AI summary

Fixed unauthenticated IDOR and stored XSS vulnerabilities.

Full changelog

Fixed unauthenticated IDOR on GET /activitypub/trail/{id} and GET /activitypub/comment/{id} — private records are now access-checked before being returned. (GHSA-9qg7-jr2x-prvh, reported by @de3erve-hunter)
Fixed stored XSS via waypoint.icon in map markers — the icon value is now validated against an allowlist before being passed to insertAdjacentHTML. (GHSA-hx3v-rv4v-w875, reported by @de3erve-hunter)
Fixed stored XSS via waypoint.name and waypoint.icon in the elevation profile — replaced unsafe innerHTML assignment with safe DOM construction. (GHSA-m7v2-6gj3-3g2p, reported by @de3erve-hunter)

GHSA-9qg7-jr2x-prvh — Fixed unauthenticated IDOR on `GET /activitypub/trail/{id}` and `GET /activitypub/comment/{id}`.
GHSA-hx3v-rv4v-w875 — Fixed stored XSS via `waypoint.icon` in map markers by allow‑listing the icon value before using `insertAdjacentHTML`.
GHSA-m7v2-6gj3-3g2p — Fixed stored XSS via `waypoint.name` and `waypoint.icon` in the elevation profile by replacing unsafe `innerHTML` with safe DOM construction.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track wanderer

Get notified when new releases ship.

About wanderer

wanderer is a self-hosted trail database. Save your adventures!