PT-2026-32628 · Debian+2 · Leaflet

Published 2026-04-14 · Updated 2026-04-19 · CVE-2025-69993

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:N/A:N/C:L/I:L/PR:N/S:C/UI:R

Name of the Vulnerable Software and Affected Versions Leaflet versions prior to 1.9.5

Description Cross-Site Scripting (XSS) occurs via the bindPopup() function. This function renders user-supplied input as raw HTML without sanitization, which allows the injection of arbitrary JavaScript code through event handler attributes. The malicious script executes in the context of the victim's browser session when they view an affected map popup.

Recommendations Update to version 1.9.5 or later. As a temporary workaround, consider restricting the use of the bindPopup() function until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-69993

Affected Products

Leaflet

References · 10

• 🔥 https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.md · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-69993 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-69993 · Security Note
• https://ubuntu.com/security/CVE-2025-69993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69993 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69993 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69993 · Vendor Advisory
• https://twitter.com/CVEnew/status/2045972397602619896 · Twitter Post
• http://leaflet.com · Note
• https://leafletjs.com · Note