CVE-2026-49294: Valhalla Routing Engine XSS Vulnerability

CVE-2026-49294 Overview

CVE-2026-49294 is a reflected cross-site scripting (XSS) vulnerability in Valhalla, an open source routing engine for OpenStreetMap data. The flaw affects versions 3.6.3 and prior. The server reflects the JSONP callback parameter directly into HTTP responses served with Content-Type: application/javascript, without validation, output encoding, or allowlist filtering. An attacker who tricks a victim into loading a crafted URL through a <script src="..."> tag can execute arbitrary JavaScript in the context of the serving origin. The issue was not fixed at the time of publication and is tracked under [CWE-79].

Critical Impact
Successful exploitation can lead to session token theft, credential disclosure, and unauthorized actions performed in the victim's browser context.

Affected Products

Valhalla routing engine versions 3.6.3 and prior
Applications embedding the Valhalla HTTP API with JSONP enabled
OpenStreetMap-based services exposing Valhalla endpoints to untrusted clients

Discovery Timeline

2026-06-15 - CVE-2026-49294 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49294

Vulnerability Analysis

Valhalla supports JSONP responses to enable cross-origin script-tag retrieval of routing data. When a request includes a callback query parameter, the server wraps the JSON payload in a function call using the supplied identifier. The vulnerable code path inserts the parameter value directly into the response body without checking that it conforms to a valid JavaScript identifier pattern.

Because the response is served with Content-Type: application/javascript, a browser loading the URL through a <script> tag will execute whatever is returned. Attacker-controlled content in the callback parameter therefore runs as script in the origin of the Valhalla server. This enables theft of cookies bound to that origin, exfiltration of data accessible from the page, and forged requests on behalf of the victim.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The JSONP handler treats the callback parameter as trusted output and skips both syntactic validation and output encoding. A defensive implementation would restrict the value to a strict regular expression such as ^[A-Za-z_$][A-Za-z0-9_$]*$ or accept only entries from a pre-registered allowlist.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page that references the Valhalla endpoint through a <script> tag whose src attribute contains a malicious callback value. When a victim with an active session on the targeted origin loads the attacker's page, the browser fetches the crafted URL and executes the injected JavaScript. See the GitHub Security Advisory for advisory details.

The vulnerability manifests in the JSONP response handler. No verified public proof-of-concept code is referenced in the advisory; the conceptual exploitation pattern involves a request such as /route?callback=<arbitrary_js> returned verbatim within the response body.

Detection Methods for CVE-2026-49294

Indicators of Compromise

HTTP request logs containing callback parameter values that include characters outside the set [A-Za-z0-9_$]
Requests to Valhalla endpoints with callback values containing parentheses, semicolons, angle brackets, or URL-encoded script payloads
Referrer headers pointing to untrusted third-party domains immediately preceding suspicious callback requests

Detection Strategies

Parse web server and reverse proxy logs for Valhalla routes carrying long or non-identifier callback parameters
Apply web application firewall (WAF) signatures that flag JSONP callbacks containing JavaScript operators or HTML metacharacters
Correlate outbound browser telemetry with requests to Valhalla hosts that return application/javascript content reflecting suspicious tokens

Monitoring Recommendations

Forward Valhalla HTTP access logs to a centralized log analytics platform and alert on anomalous callback parameter entropy or length
Monitor browser-side Content Security Policy (CSP) violation reports for script execution originating from Valhalla domains
Track upstream changes in the Valhalla GitHub repository for a fix commit referencing this advisory

How to Mitigate CVE-2026-49294

Immediate Actions Required

Disable the JSONP callback feature on Valhalla endpoints if it is not required by client applications
Place affected Valhalla deployments behind a reverse proxy that strips or validates the callback parameter
Restrict access to Valhalla HTTP endpoints to trusted networks or authenticated clients until a patch is available

Patch Information

According to the GitHub Security Advisory GHSA-85xx-39j8-r56x, the issue was not fixed at the time of publication. Operators should monitor the upstream project for a patched release and apply it as soon as it becomes available.

Workarounds

Enforce a strict allowlist regular expression such as ^[A-Za-z_$][A-Za-z0-9_$]{0,63}$ for the callback parameter at the proxy layer
Override the response Content-Type to application/json and reject requests containing a callback parameter
Deploy a Content Security Policy (CSP) on consuming applications that forbids loading scripts from the Valhalla origin

bash

# Example NGINX rule rejecting non-identifier JSONP callbacks
location /route {
    if ($arg_callback !~ "^[A-Za-z_$][A-Za-z0-9_$]{0,63}$") {
        return 400;
    }
    proxy_pass http://valhalla_backend;
}