Skip to content
OpenAdvisories

Package · SwiftURL

github.com/vapor/leaf-kit

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.9
    CVE-2026-28499

    LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

    LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to…

    vapor leaf-kit github.com/vapor/leaf-kit SwiftURL
  • Medium 6.1
    CVE-2026-27120

    Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

    Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster contai…

    vapor leaf-kit github.com/vapor/leaf-kit SwiftURL
  • High 7.4
    CVE-2021-37634

    LeafKit allows XSS with untrusted user input

    Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any string…

    vapor leaf-kit github.com/vapor/leaf-kit SwiftURL