Executive Summary

CVE-2026-49294 is a reflected Cross-Site Scripting (XSS) vulnerability in the Valhalla routing engine versions up to 3.6.3. It occurs because the JSONP callback parameter is not properly validated or sanitized before being included in the HTTP response body with a Content-Type of application/javascript.

An attacker can craft a malicious URL containing JavaScript code in the JSONP callback parameter. When a victim loads this URL via a <script> tag, the injected script executes in the context of the vulnerable site, potentially compromising the victim's session or credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of arbitrary JavaScript in the victim's browser under the vulnerable site's origin. This can result in session token theft, credential disclosure, or unauthorized actions performed on behalf of the victim.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Valhalla server is reflecting unsanitized input from the JSONP callback parameter in HTTP responses with Content-Type: application/javascript.

One way to detect it is to send a crafted HTTP request to the Valhalla server including a JSONP callback parameter with a unique string or JavaScript code and observe if it is reflected unescaped in the response.

For example, you can use curl to send such a request and inspect the response:

• curl -i 'http://<valhalla-server>/route?jsonp=alert(1)'

If the response body contains the exact callback parameter value (e.g., alert(1)) without any encoding or validation, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves implementing strict validation on the JSONP callback parameter to allow only safe characters, such as alphanumeric characters and underscores, using a regular expression whitelist.

If you are running a vulnerable version (3.6.3 or prior), consider upgrading to a fixed version once available.

As a temporary workaround, you can disable JSONP support or block requests containing the JSONP callback parameter at the web server or firewall level.

Additionally, educate users to avoid loading untrusted URLs that include JSONP callbacks from your Valhalla instance.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a reflected Cross-Site Scripting (XSS) issue that can lead to session token theft, credential disclosure, or unauthorized actions performed on behalf of the victim.

Such security weaknesses can potentially impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal data and secure handling of user credentials to prevent unauthorized access and data breaches.

However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with these standards.

Useful 0 Not Useful 0