Executive Summary

CVE-2026-28499 is a cross-site scripting (XSS) vulnerability in the LeafKit Swift templating language prior to version 1.14.2. The issue occurs because HTML escaping does not work correctly when a template prints collections such as Arrays or Dictionaries using the syntax #(value).

Specifically, the vulnerability arises from the failure of the LeafKit `htmlEscaped()` method to properly convert collection types to strings before escaping. This causes unescaped user-controlled data to be rendered in HTML, enabling attackers to inject malicious scripts.

The problem was fixed in version 1.14.2 by improving the data conversion and HTML escaping logic to ensure all collection values are properly escaped.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'If you use Vapor LeafKit to render templates that include user-controlled data inside collections (Arrays or Dictionaries) with the #(value) syntax, this vulnerability can allow attackers to inject arbitrary scripts into your web pages.'}, {'type': 'paragraph', 'content': "This can lead to Cross-Site Scripting (XSS) attacks, where malicious JavaScript runs in the context of your users' browsers, potentially stealing sensitive information, hijacking user sessions, or performing other malicious actions."}, {'type': 'paragraph', 'content': 'The vulnerability has a moderate severity with a CVSS v4 base score of 6.9, indicating it is exploitable over the network with low complexity and no privileges or user interaction required.'}] [1, 2]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper HTML escaping of collection values (Arrays or Dictionaries) in LeafKit templates when using the syntax #(value). Detection involves identifying if your application uses LeafKit versions prior to 1.14.2 and renders user-controlled data inside collections with this syntax.

To detect potential exploitation or presence of this vulnerability, you can look for unescaped HTML or JavaScript in rendered templates that include collection data. Monitoring HTTP responses for suspicious script injections or unexpected HTML content in places where collections are rendered can help.

Specific commands depend on your environment, but general approaches include:

• Using web application scanners or proxy tools (e.g., OWASP ZAP, Burp Suite) to test for reflected XSS by submitting payloads in collection data inputs.
• Searching your codebase for LeafKit template usage of #(value) with collection types to identify vulnerable code paths.
• Checking your LeafKit package version with commands like `swift package show-dependencies` or inspecting your dependency manager files to confirm if LeafKit is below version 1.14.2.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to upgrade LeafKit to version 1.14.2 or later, where the vulnerability is fixed by properly escaping collection values in templates.

If upgrading immediately is not possible, consider:

• Avoid rendering user-controlled data inside collections using the #(value) syntax in Leaf templates.
• Manually sanitize or escape any user input before it is passed into Leaf templates.
• Review and audit your templates and application code to identify and refactor any usage patterns that render collections directly.

Applying these mitigations reduces the risk of XSS attacks until the update can be applied.

Useful 0 Not Useful 0