CVE-2026-27120

MEDIUM EPSS 13.7%
Published Feb 20, 20264mo ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Feb 20, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
13.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-75
CWE-79 Cross-site Scripting Injection
CWE-87

Affected Products 1

VendorProductVersionRange
vaporleafkit* <1.14.1

References 2

  • github.com https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34
    Patch
  • github.com https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34
    Patch