CVE-2026-27120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27120", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-17T18:42:27.043Z", "datePublished": "2026-02-20T21:27:09.642Z", "dateUpdated": "2026-02-24T18:41:10.070Z"}, "containers": {"cna": {"title": "Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster", "problemTypes": [{"descriptions": [{"cweId": "CWE-75", "lang": "en", "description": "CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-87", "lang": "en", "description": "CWE-87: Improper Neutralization of Alternate XSS Syntax", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p"}, {"name": "https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34", "tags": ["x_refsource_MISC"], "url": "https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34"}], "affected": [{"vendor": "vapor", "product": "leaf-kit", "versions": [{"version": "< 1.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T21:27:09.642Z"}, "descriptions": [{"lang": "en", "value": "Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1."}], "source": {"advisory": "GHSA-4hfh-fch3-5q7p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:40:50.919491Z", "id": "CVE-2026-27120", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:41:10.070Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27120", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:40:50.919491Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:41:01.691Z"}}], "cna": {"title": "Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster", "source": {"advisory": "GHSA-4hfh-fch3-5q7p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "vapor", "product": "leaf-kit", "versions": [{"status": "affected", "version": "< 1.4.1"}]}], "references": [{"url": "https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p", "name": "https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34", "name": "https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-75", "description": "CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-87", "description": "CWE-87: Improper Neutralization of Alternate XSS Syntax"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-20T21:27:09.642Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27120", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:41:10.070Z", "dateReserved": "2026-02-17T18:42:27.043Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-20T21:27:09.642Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "leaf-kit", "vendor": "vapor", "versions": [{"status": "affected", "version": "< 1.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vapor:leafkit:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C7EB8C5-FF4D-411D-900E-B94DFC1235DF", "versionEndExcluding": "1.14.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1."}, {"lang": "es", "value": "Leafkit es un lenguaje de plantillas con sintaxis inspirada en Swift. Antes de la versi\u00f3n 1.4.1, htmlEscaped en leaf-kit solo escapar\u00e1 los caracteres especiales HTML si los cl\u00fasteres de grafemas extendidos coinciden, lo que permite eludir el escape utilizando un cl\u00faster de grafemas extendido que contenga tanto el car\u00e1cter especial HTML como algunos caracteres adicionales. En el caso de los atributos HTML, esto puede llevar a XSS si hay una variable leaf en el atributo que est\u00e1 controlada por el usuario. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.4.1."}], "id": "CVE-2026-27120", "lastModified": "2026-06-17T10:26:42.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27120", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:40:50.919491Z", "version": "2.0.3"}}]}, "published": "2026-02-20T22:16:29.830", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-75"}, {"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-87"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.1)"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "leaf-kit", "source": "cna", "vendor": "vapor"}, "product": "leafkit", "vendor": "vapor"}], "analysis": {"en": {"generated_at": "2026-04-18T11:25:35.946000+00:00", "value": {"mitigation_remediation": ["Upgrade LeafKit to version 1.4.1 or later, which contains the fix for the escaping bypass.", "Implement a strict Content Security Policy that restricts inline script execution and limits origins to mitigate the impact of any potential XSS attacks.", "Review all template usages where user data is inserted into HTML attributes and enforce additional sanitization or manual escaping if the data cannot be guaranteed safe."], "summary": {"action": "Apply patch", "impact": "Cross\u2011Site Scripting in HTML attributes"}, "threat_synthesis": {"affected_systems": "Vapor\u2019s LeafKit templating library of any version prior to 1.4.1 is affected. The issue applies to all installations where the library is used to populate HTML attributes with untrusted content. The vendor is Vapor; the product is LeafKit.", "description_and_impact": "LeafKit\u2019s htmlEscaped function failed to escape certain characters when part of an extended grapheme cluster. This flaw permits an attacker to supply a crafted input that contains a special HTML character hidden inside a grapheme cluster, which is not escaped and can be injected into an HTML attribute. The injection can lead to client\u2011side cross\u2011site scripting (XSS) if the vulnerable variable is derived from user\u2011controlled data. The weakness is a form of improper escaping (CWE\u201175 and CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.1 signals a moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is client\u2011side; the attacker would need to influence the user\u2011controlled data that passes through LeafKit, typically via a form or API payload. If successful, the attacker can execute arbitrary JavaScript in the victim\u2019s browser, compromising confidentiality, integrity, or integrity of user sessions."}}}}, "created": "2026-02-23T14:35:01.432479+00:00", "updated": "2026-04-18T11:30:44.322384+00:00", "vendors": ["vapor", "vapor$PRODUCT$leafkit"]}