Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
@LeafletJS 🚨 Your library has a reported XSS vulnerability (CVE-2025-69993 / Snyk) in versions up to 1.9.4 via bindPopup() – malicious HTML/event handlers can execute in popups. Many apps (including ours) rely heavily on Leaflet maps. Please release a stable patched version soon
Post summary
The tweet announces an XSS flaw in LeafletJS (CVE‑2025‑69993) affecting versions up to 1.9.4, calling for a prompt patch release.
CVE-2025-69993 Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTM… https://www.cve.org/CVERecord?id=CVE-2025-69993
Post summary
This post announces a newly disclosed XSS vulnerability in Leaflet’s bindPopup() method that affects versions up to 1.9.4, providing key technical details but no exploitation or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | leafletjs | leaflet | - | node.js | - |