CVE-2026-27120
XSS Vulnerability in Leafkit htmlEscaped Function Before
Publication date: 2026-02-20
Last updated on: 2026-03-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vapor | leafkit | to 1.14.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-87 | The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-75 | The product does not adequately filter user-controlled input for special elements with control implications. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Leafkit, a templating language with Swift-inspired syntax, specifically in versions prior to 1.4.1. The issue is with the htmlEscaped function, which is supposed to escape HTML special characters to prevent injection attacks. However, it only escapes characters if the extended grapheme clusters match exactly. Attackers can bypass this escaping by using an extended grapheme cluster that contains both a special HTML character and additional characters. This flaw can lead to improper escaping of user-controlled variables in HTML attributes, potentially allowing cross-site scripting (XSS) attacks.
How can this vulnerability impact me? :
The vulnerability can lead to cross-site scripting (XSS) attacks when user-controlled variables are included in HTML attributes without proper escaping. This means an attacker could inject malicious scripts into web pages rendered by Leafkit, potentially compromising the security of users by stealing cookies, session tokens, or performing actions on behalf of the user.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade leaf-kit to version 1.4.1 or later, where the issue with htmlEscaped escaping has been fixed.