PT-2026-25815 · Leafkit · Leafkit
Icmddev
·
Published
2026-03-16
·
Updated
2026-03-18
·
CVE-2026-28499
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
LeafKit versions prior to 1.14.2
Description
LeafKit is a templating language with Swift-inspired syntax. Before version 1.14.2, HTML escaping does not function correctly when a template prints a collection (Array or Dictionary) using
#(value). This can lead to cross-site scripting (XSS), allowing potentially untrusted input to be rendered without proper escaping. The issue stems from the LeafData.htmlEscaped() function's implementation, which returns an unescaped self when converting Arrays and Dictionaries to strings, as their conversion to String is considered ambiguous. The vulnerability is triggered when serializing these unescaped collections, leading to unsafe serialization of each element within them. A proof of concept (PoC) demonstrates that providing malicious input within an array or dictionary can trigger XSS when rendered in a Leaf template.Recommendations
Update to LeafKit version 1.14.2 or later.
Exploit
Fix
XSS
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Leafkit