Leaflet’s bindPopup() method renders any string passed to it as raw HTML inside a popup without sanitization, allowing an attacker to inject HTML elements that carry event handler attributes such as onerror. When a user opens the popup, the embedded JavaScript executes in the context of the web application, enabling the attacker to steal cookies, hijack sessions, or perform further malicious actions. This results in compromised confidentiality and integrity of data processed by the application.

All web applications that use the open‑source Leaflet mapping library with a version up to and including 1.9.4 are affected. The flaw applies to any vendor or project that ships or incorporates these releases, regardless of deployment environment. Upgrading to a version newer than 1.9.4 removes the vulnerability.

The CVSS score of 6.1 indicates medium severity, and the absence of an EPSS score means the likelihood of exploitation is uncertain. Exploitation requires that the attacker can insert untrusted content into a popup, a scenario common in applications that display dynamic user data in map popups. The attack is client‑side and does not require special privileges; however, it can lead to significant damage if users load malicious content. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no large‑scale public exploits have been documented yet.