LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
exploitation probability
0.3%top 82% of all CVEs
observed exploitation
nono source reports it
In short
LeafKit's template engine fails to properly escape HTML when printing collections (arrays or dictionaries), allowing malicious code to be displayed unescaped in web pages if untrusted data is included.
Technical detail
LeafKit prior to 1.14.2 improperly handles HTML entity encoding for collection-type values in the #(value) template syntax, enabling stored or reflected XSS attacks when user-controlled data is rendered without sanitization. The vulnerability arises from incomplete output encoding logic specific to array and dictionary types.
Summary generated and translated by AI from the official description.
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
vapor · leaf-kit