CVE-2026-28499: LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-18 · updated 2026-06-17
Weakness: CWE-79

Description

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.

Affected products

vapor Leafkit: before 1.14.2 — fixed in 1.14.2

How to fix

Upgrade to a fixed version: vapor Leafkit 1.14.2. Check the vendor advisory for mitigations.

References

https://github.com/vapor/leaf-kit/commit/6044b844caa858a0c5f2505ac166f5a057c990dc
https://github.com/vapor/leaf-kit/releases/tag/1.14.2
https://github.com/vapor/leaf-kit/security/advisories/GHSA-6jj5-j4j8-8473
https://github.com/vapor/leaf-kit/security/advisories/GHSA-6jj5-j4j8-8473

Get alerted when CVE-2026-28499 or the next vulnerability affects your stack