Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

published 2026-02-19 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-7783 , GHSA-4hfh-fch3-5q7p

cvss: 6.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits: 0; none known

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

Patch / fix

fixed in 2 links 1

swift github.com/vapor/leaf-kit 1.4.1
vapor leafkit 1.14.1

github.com/vapor/leaf-kit@8919e39 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 8 mo ago (2026-02-24)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
swift	github.com/vapor/leaf-kit	<1.4.1	1.4.1

Affected products

vapor leaf-kit

Classification

Weakness

CWE-75 Failure to Sanitize Special Elements into a Different Plane
CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-87 Improper Neutralization of Alternate XSS Syntax

References

github.com /vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34
web, patch
github.com /vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7p
web, exploit, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-27120
advisory
github.com /vapor/leaf-kit
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary