CVE-2026-28499 — LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionar…
Published: 2026-03-18 · CVSS: 6.9 · CVSS 4.0
LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7