Description
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vapor | leaf-kit | < 1.14.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| SwiftURL | github.com/vapor/leaf-kit | < 1.14.2 | 1.14.2 | GHSA-6jj5-j4j8-8473 |