CVE-2026-27120
Received Received - Intake
XSS Vulnerability in Leafkit htmlEscaped Function Before

Publication date: 2026-02-20

Last updated on: 2026-03-02

Assigner: GitHub, Inc.

Description
Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-20
Last Modified
2026-03-02
Generated
2026-06-16
AI Q&A
2026-02-21
EPSS Evaluated
2026-06-14
NVD
CVE-2026-27120
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
vapor leafkit to 1.14.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-87 The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
CWE-75 The product does not adequately filter user-controlled input for special elements with control implications.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Leafkit, a templating language with Swift-inspired syntax, specifically in versions prior to 1.4.1. The issue is with the htmlEscaped function, which is supposed to escape HTML special characters to prevent injection attacks. However, it only escapes characters if the extended grapheme clusters match exactly. Attackers can bypass this escaping by using an extended grapheme cluster that contains both a special HTML character and additional characters. This flaw can lead to improper escaping of user-controlled variables in HTML attributes, potentially allowing cross-site scripting (XSS) attacks.

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks when user-controlled variables are included in HTML attributes without proper escaping. This means an attacker could inject malicious scripts into web pages rendered by Leafkit, potentially compromising the security of users by stealing cookies, session tokens, or performing actions on behalf of the user.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade leaf-kit to version 1.4.1 or later, where the issue with htmlEscaped escaping has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27120. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart