Skip to content
OpenAdvisories

Package · SwiftURL

github.com/vapor/leaf-kit

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-28499

    LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

    LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to…

    vapor leaf-kit github.com/vapor/leaf-kit SwiftURL
  • Medium 6.1
    CVE-2026-27120

    Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

    Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster contai…

    vapor leaf-kit github.com/vapor/leaf-kit SwiftURL