XSS in Vapor Leaf-kit

CVE-2026-28499

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentiall…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.000 (4.2th percentile) — read the EPSS interpretation.

Affected products

Vapor Leaf-kit — versions < 1.14.2

Weakness classification (CWE)

References

https://github.com/vapor/leaf-kit/security/advisories/GHSA-6jj5-j4j8-8473 (x_refsource_CONFIRM)
https://github.com/vapor/leaf-kit/commit/6044b844caa858a0c5f2505ac166f5a057c990dc (x_refsource_MISC)
https://github.com/vapor/leaf-kit/releases/tag/1.14.2 (x_refsource_MISC)