Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27120 Cross-Site Scripting in Leafkit Before 1.4.1 via HTML Attribute Escaping Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27120
Post summary
The entry highlights a CVE for an XSS vulnerability in Leafkit before 1.4.1, describing an HTML attribute escaping bypass. No PoC, exploit, patch, or active exploitation evidence is provided.
CVE-2026-27120 Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme… https://www.cve.org/CVERecord?id=CVE-2026-27120
Post summary
Leafkit's htmlEscaped function improperly escapes characters when extended grapheme sets are involved before v1.4.1; no PoC, exploit, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vapor | leafkit | - | - | - |