LeafKit is a templating language that, before version 1.14.2, fails to escape HTML when a template outputs a collection using #(value). This bug allows untrusted input containing malicious script or HTML to be rendered directly into the page, resulting in a Cross‑Site Scripting (XSS) vulnerability. The weakness corresponds to CWE‑79 and CWE‑80 (Cross‑site Scripting) and involves improper handling of textual content (CWE‑116).

Affected systems include all installations of vapor:leaf-kit running a version earlier than 1.14.2. The vulnerability is present in all releases preceding the 1.14.2 fix, and applies to the generic cpe:2.3:a:vapor:leafkit:*:*:*:*:*:*:*:* platform. Applying the update to v1.14.2 or later resolves the issue.

The CVSS v3 score is 6.9, indicating medium severity. The EPSS score is below 1%, suggesting a low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by providing crafted data to the template rendering process, typically via a web form or API that feeds untrusted values into LeafKit templates. Because the output is not encoded, injected JavaScript can execute in the context of the user’s browser, potentially leading to session hijacking or the disclosure of sensitive information.