LeafWiki renders page titles returned by its search API directly into the browser using dangerouslySetInnerHTML, without escaping them. A page title that contains arbitrary HTML or JavaScript will therefore be executed in the victim’s browser when the search results are displayed. An attacker who can create or edit a page title with a malicious payload can then trigger that code by having any user perform a search that matches the title. The impact is the execution of attacker supplied script in the context of the victim’s browser, which can be used for session hijacking, data exfiltration, or further attacks on the host system.

All installations of perber:leafwiki running a version older than 0.10.2 are affected because the front‑end did not escape search-result titles. When the deployment is started with the --public-access flag, unauthenticated visitors can load the search page and trigger the payload. In deployments that restrict search to authenticated users, the flaw still allows cross‑user XSS against logged‑in users who have permission to view search results.

The CVSS score of 4.8 indicates a moderate overall severity, and the EPSS score is not currently available, so the likelihood of exploitation is unknown. The flaw is not listed in CISA’s KEV catalog. Successful exploitation requires the attacker to have editing privileges to set a malicious title, and the target victim must view the search result. Because the vulnerability involves stored cross‑site scripting and the upstream fix is available, the risk is considered moderate but should be mitigated promptly, especially on publicly exposed instances.