swifturl github.com/vapor/leaf-kit vulnerabilities

Latest swifturl github.com/vapor/leaf-kit CVEs

Newest publication first

1. CVE-2026-28499 LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

   Published 2026-03-18

   Medium·CVSS 6.9 EPSS 0.28%

   LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via #(value). This can result in XSS, allowing potentially untrusted input to be rendered unescaped....

2. CVE-2026-27120 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

   Published 2026-02-20

   Medium·CVSS 6.1 EPSS 0.27%

   Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special...

3. CVE-2021-37634 LeafKit allows XSS with untrusted user input

   Published 2021-08-09

   Medium·CVSS 6.1 EPSS 0.71%

   Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as v...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.