LeafKit’s htmlEscaped function failed to escape certain characters when part of an extended grapheme cluster. This flaw permits an attacker to supply a crafted input that contains a special HTML character hidden inside a grapheme cluster, which is not escaped and can be injected into an HTML attribute. The injection can lead to client‑side cross‑site scripting (XSS) if the vulnerable variable is derived from user‑controlled data. The weakness is a form of improper escaping (CWE‑75 and CWE‑79).

Vapor’s LeafKit templating library of any version prior to 1.4.1 is affected. The issue applies to all installations where the library is used to populate HTML attributes with untrusted content. The vendor is Vapor; the product is LeafKit.

The CVSS score of 6.1 signals a moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is client‑side; the attacker would need to influence the user‑controlled data that passes through LeafKit, typically via a form or API payload. If successful, the attacker can execute arbitrary JavaScript in the victim’s browser, compromising confidentiality, integrity, or integrity of user sessions.