CVE-2026-28499

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80 CWE-116

Affected software

Vendor	Product	Versions
vapor	leaf-kit	< 1.14.2

References

https://github.com/vapor/leaf-kit/commit/6044b844caa858a0c5f2505ac166f5a057c990dcPatch
https://github.com/vapor/leaf-kit/releases/tag/1.14.2Release Notes
https://github.com/vapor/leaf-kit/security/advisories/GHSA-6jj5-j4j8-8473Exploit, Vendor Advisory
https://github.com/vapor/leaf-kit/security/advisories/GHSA-6jj5-j4j8-8473Exploit, Vendor Advisory

Timeline

Published: Mar 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-28506.5A vulnerability was found in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function addCustomer/updateCu CVE-2026-285009.1Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a sec CVE-2026-285019.8WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within CVE-2026-285028.8WWBN AVideo is an open source video platform. Prior to version 24.0, an authenticated Remote Code Execution (RCE) vulnerability was identifi CVE-2026-285036.5Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncVi CVE-2026-2850510.0Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notificat CVE-2026-285064.3Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity CVE-2026-285077.2Idno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write a CVE-2026-285088.6Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the CVE-2026-285095.4LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeR CVE-2026-28515.3A vulnerability was determined in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This vulnerability affects the function a CVE-2026-285105.9eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-fac