CVE-2026-28499
XSS Vulnerability in LeafKit Templates via Unescaped Collections
Publication date: 2026-03-18
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vapor | leafkit | to 1.14.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-28499 is a cross-site scripting (XSS) vulnerability in the LeafKit Swift templating language prior to version 1.14.2. The issue occurs because HTML escaping does not work correctly when a template prints collections such as Arrays or Dictionaries using the syntax #(value).
Specifically, the vulnerability arises from the failure of the LeafKit `htmlEscaped()` method to properly convert collection types to strings before escaping. This causes unescaped user-controlled data to be rendered in HTML, enabling attackers to inject malicious scripts.
The problem was fixed in version 1.14.2 by improving the data conversion and HTML escaping logic to ensure all collection values are properly escaped.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'If you use Vapor LeafKit to render templates that include user-controlled data inside collections (Arrays or Dictionaries) with the #(value) syntax, this vulnerability can allow attackers to inject arbitrary scripts into your web pages.'}, {'type': 'paragraph', 'content': "This can lead to Cross-Site Scripting (XSS) attacks, where malicious JavaScript runs in the context of your users' browsers, potentially stealing sensitive information, hijacking user sessions, or performing other malicious actions."}, {'type': 'paragraph', 'content': 'The vulnerability has a moderate severity with a CVSS v4 base score of 6.9, indicating it is exploitable over the network with low complexity and no privileges or user interaction required.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves improper HTML escaping of collection values (Arrays or Dictionaries) in LeafKit templates when using the syntax #(value). Detection involves identifying if your application uses LeafKit versions prior to 1.14.2 and renders user-controlled data inside collections with this syntax.
To detect potential exploitation or presence of this vulnerability, you can look for unescaped HTML or JavaScript in rendered templates that include collection data. Monitoring HTTP responses for suspicious script injections or unexpected HTML content in places where collections are rendered can help.
Specific commands depend on your environment, but general approaches include:
- Using web application scanners or proxy tools (e.g., OWASP ZAP, Burp Suite) to test for reflected XSS by submitting payloads in collection data inputs.
- Searching your codebase for LeafKit template usage of #(value) with collection types to identify vulnerable code paths.
- Checking your LeafKit package version with commands like `swift package show-dependencies` or inspecting your dependency manager files to confirm if LeafKit is below version 1.14.2.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to upgrade LeafKit to version 1.14.2 or later, where the vulnerability is fixed by properly escaping collection values in templates.
If upgrading immediately is not possible, consider:
- Avoid rendering user-controlled data inside collections using the #(value) syntax in Leaf templates.
- Manually sanitize or escape any user input before it is passed into Leaf templates.
- Review and audit your templates and application code to identify and refactor any usage patterns that render collections directly.
Applying these mitigations reduces the risk of XSS attacks until the update can be applied.