CVE-2026-28499
LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
In short
LeafKit's template engine fails to properly escape HTML when printing collections (arrays or dictionaries), allowing malicious code to be displayed unescaped in web pages if untrusted data is included.
Technical detail
LeafKit prior to 1.14.2 improperly handles HTML entity encoding for collection-type values in the #(value) template syntax, enabling stored or reflected XSS attacks when user-controlled data is rendered without sanitization. The vulnerability arises from incomplete output encoding logic specific to array and dictionary types.
Summary generated and translated by AI from the official description.
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
vapor · leaf-kitWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →