CVE-2026-27120

Katalog CVE

CVSS 6.1 · Medium EPSS 0,30%

Kerentanan Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) pada vapor leafkit. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-87: Improper Neutralization of Alternate XSS Syntax

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p exploit · advisory vendor
• https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34 patch