CVE-2026-49294— valhalla 跨站脚本漏洞

Valhalla has reflected XSS via unsanitized JSONP callback parameter

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting (XSS) due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the HTTP response body with Content-Type: application/javascript, without any validation, output encoding, or allowlist filtering. An attacker can craft a URL containing arbitrary JavaScript in the callback parameter; if a victim is induced to load that URL via a <script src="..."> tag, the injected script executes in the context of the serving origin, potentially leading to session token theft, credential disclosure, or actions performed on behalf of the victim. This issue was not fixed at time of publication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

valhalla 跨站脚本漏洞

valhalla是美国valhalla组织的一个应用服务器产品。 Valhalla 3.6.3及之前版本存在跨站脚本漏洞，该漏洞源于JSONP回调参数输入中和不当，可能导致攻击者通过注入任意JavaScript脚本进行反射型跨站脚本攻击，进而可能造成会话令牌窃取、凭据泄露或代表受害者执行操作。

N/A

N/A