CVE-2026-49294: Valhalla JSONP Callback XSS Vulnerability (Versions ≤3.6.3)

Technical summary

Valhalla's JSONP callback handler accepts arbitrary callback parameter values and reflects them into the HTTP response body with Content-Type: application/javascript without validation, output encoding, or allowlist enforcement. When a victim loads a malicious URL via a <script> tag or other mechanism, the injected JavaScript executes in the same origin context as the legitimate application, bypassing same-origin policy protections for JSONP patterns. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects all versions up to and including 3.6.3. No patch was available at the time of publication.

Business impact

Organizations relying on Valhalla for routing services may expose end users or internal systems to session hijacking, credential theft, or unauthorized transaction execution. If Valhalla is integrated into a web application or API layer serving authenticated users, a successful XSS attack could compromise user trust, enable lateral movement into downstream systems, or result in data exfiltration. The requirement for user interaction (clicking a malicious link) limits broad-scale exploitation but does not eliminate risk, especially in environments where social engineering is effective or where URLs are shared via messaging systems.

Affected systems

Valhalla versions 3.6.3 and prior are vulnerable. The risk applies to deployments where Valhalla is exposed via HTTP endpoints that accept JSONP callbacks, particularly in public-facing routing services or embedded mapping applications. Projects bundling Valhalla as a dependency and exposing its JSONP endpoints without additional security controls are at highest risk. Development and staging environments using affected versions are also in scope if they handle real or sensitive data.

Exploitability

Exploitation requires user interaction—a victim must visit or load a URL crafted by the attacker. However, the attack surface is significant: any URL-sharing mechanism (chat, email, social media, embedded links in web pages) can distribute the malicious payload. The vulnerability is trivially exploitable from a technical standpoint (no special tools, complex techniques, or authentication required), making it attractive to opportunistic attackers. The reflected nature means each attack is a discrete incident; persistent compromise is not achieved through this vector alone. CVSS 6.1 (Medium) reflects the balance between broad network accessibility, low complexity, required user interaction, and moderate confidentiality and integrity impact.

Remediation

Immediate action is to review which internal or customer-facing applications depend on Valhalla and whether they expose JSONP endpoints. If JSONP functionality is not required, disable or remove callback parameter support entirely. If JSONP is necessary, implement strict output encoding and callback parameter validation—whitelist acceptable callback names or enforce that callback values match a defined pattern (e.g., alphanumeric characters only). Upgrade to a patched version once available from the Valhalla project; monitor the official GitHub repository or security advisories for release announcements. For applications where patching is delayed, consider deploying a Web Application Firewall (WAF) rule to block requests with suspicious callback parameter content.

Patch guidance

As of the publication date, no official patch has been released for Valhalla. Monitor the Valhalla project's GitHub releases page and security advisory channels for version 3.6.4 or later. When a patch becomes available, test it thoroughly in a non-production environment to ensure compatibility with your specific integration before deploying to production. Organizations unable to patch immediately should implement compensating controls such as callback parameter validation at the application or WAF level, or disable JSONP support if operationally feasible.

Detection guidance

Search for HTTP requests to Valhalla endpoints containing callback parameters with suspicious values—look for JavaScript keywords (e.g., 'alert', 'fetch', 'XMLHttpRequest', 'eval'), special characters (semicolons, parentheses, angle brackets), or URL-encoded payloads. Monitor web application logs and WAF telemetry for callback parameter anomalies. Check HTTP responses with Content-Type: application/javascript for unexpected script content. In development environments, use security scanning tools to identify JSONP endpoints and test callback parameter handling. Network-based detection should flag callback parameters containing script-like syntax patterns.

Why prioritize this

While CVSS scores this as Medium severity, prioritization depends on context. Organizations with public-facing Valhalla instances or those embedding Valhalla in user-facing applications should treat this as higher priority, particularly if users are authenticated or handle sensitive data. The attack requires user interaction but is otherwise unconstrained—no special tools, no authentication, and trivial to exploit. Lack of a patch at publication amplifies urgency; remediation through workarounds or controls is necessary immediately rather than deferred to a future patch cycle.

Risk score, explained

CVSS 6.1 reflects: (1) Network accessibility with no authentication required (AV:N, PR:N); (2) Low attack complexity—standard XSS injection techniques (AC:L); (3) Required user interaction—victim must click or load the malicious URL (UI:R); (4) Changed scope—the script runs in the browser and can affect other origins via JSONP patterns (S:C); (5) Low confidentiality impact—session tokens or credentials can be stolen (C:L); (6) Low integrity impact—the attacker can perform actions on behalf of the user within that origin (I:L); (7) No availability impact (A:N). The score balances broad attack surface and easy exploitation against the need for user interaction and moderate impact.

Frequently asked questions