CVE-2026-27120

Received Received - Intake

XSS Vulnerability in Leafkit htmlEscaped Function Before

Publication date: 2026-02-20

Last updated on: 2026-03-02

Assigner: GitHub, Inc.

Description

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-20

Last Modified

2026-03-02

Generated

2026-07-06

AI Q&A

2026-02-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27120

Affected Vendors & Products

Vendor	Product	Version / Range
vapor	leafkit	to 1.14.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-75	The product does not adequately filter user-controlled input for special elements with control implications.
CWE-87	The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Leafkit, a templating language with Swift-inspired syntax, specifically in versions prior to 1.4.1. The issue is with the htmlEscaped function, which is supposed to escape HTML special characters to prevent injection attacks. However, it only escapes characters if the extended grapheme clusters match exactly. Attackers can bypass this escaping by using an extended grapheme cluster that contains both a special HTML character and additional characters. This flaw can lead to improper escaping of user-controlled variables in HTML attributes, potentially allowing cross-site scripting (XSS) attacks.

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks when user-controlled variables are included in HTML attributes without proper escaping. This means an attacker could inject malicious scripts into web pages rendered by Leafkit, potentially compromising the security of users by stealing cookies, session tokens, or performing actions on behalf of the user.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade leaf-kit to version 1.4.1 or later, where the issue with htmlEscaped escaping has been fixed.

Hi! I’m here to help you understand CVE-2026-27120. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70