CVE-2026-28499CWE-116CWE-79CWE-80

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

Medium · published March 18, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00348 · 27.2th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-03-18T01:19Z
EPSS history
Timeline
  • 18 MAR 01:19Z
    LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
    cvelistv5