https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:58:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276444 EUVD-2026-276444 https://cve.radiocsirt.org/vuln/euvd-2026-276444 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28499 <p>LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn&#39;t work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.</p> <p>LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn&#39;t work correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped. Version 1.14.2 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28499 https://cve.radiocsirt.org/vuln/ghsa-6jj5-j4j8-8473 <p><strong>Affected:</strong> SwiftURL: github.com/vapor/leaf-kit</p> <p>### Summary LeafKit HTML-escaping is not working correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped.</p> <p>### Details LeafKit attempts to escape expressions during serialization, but due to [`LeafData.htmlEscaped()`](https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L322)&#39;s implementation, when the escaped type&#39;s conversion to `String` is marked as `.ambiguous` (as it is the case for Arrays and Dictionaries), an unescaped `self` is returned.</p> <p>&gt; **Note: I recommend first looking at the POC, before taking a look at the details below, as it is simple.** In the detailed, verbose analysis below, I explored the functions involved in more detail, in hopes that it will help you understand and locate this issue.</p> <p>#### The issue&#39;s detailed analysis: 1. Leaf expression serialization eventually reaches `LeafSerializer`&#39;s `serialize` private function below. This is where the `leafData` is `.htmlEscaped()`, and then serialized.</p> <p>https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafSerialize/LeafSerializer.swift#L60-L66</p> <p>2. The `LeafData.htmlEscaped()` method uses the `LeafData.string` computed property to convert itself to a string. Then, it calls the `htmlEscaped()` method on it. However, if the string conversion fails, notice that an unescaped, unsafe `self`…</p> <p><strong>Affected:</strong> SwiftURL: github.com/vapor/leaf-kit</p> <p>### Summary LeafKit HTML-escaping is not working correctly when a template prints a collection (Array / Dictionary) via `#(value)`. This can result in XSS, allowing potentially untrusted input to be rendered unescaped.</p> <p>### Details LeafKit attempts to escape expressions during serialization, but due to [`LeafData.htmlEscaped()`](https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafData/LeafData.swift#L322)&#39;s implementation, when the escaped type&#39;s conversion to `String` is marked as `.ambiguous` (as it is the case for Arrays and Dictionaries), an unescaped `self` is returned.</p> <p>&gt; **Note: I recommend first looking at the POC, before taking a look at the details below, as it is simple.** In the detailed, verbose analysis below, I explored the functions involved in more detail, in hopes that it will help you understand and locate this issue.</p> <p>#### The issue&#39;s detailed analysis: 1. Leaf expression serialization eventually reaches `LeafSerializer`&#39;s `serialize` private function below. This is where the `leafData` is `.htmlEscaped()`, and then serialized.</p> <p>https://github.com/vapor/leaf-kit/blob/8ff06839d8b3ddf74032d2ade01e3453eb556d30/Sources/LeafKit/LeafSerialize/LeafSerializer.swift#L60-L66</p> <p>2. The `LeafData.htmlEscaped()` method uses the `LeafData.string` computed property to convert itself to a string. Then, it calls the `htmlEscaped()` method on it. However, if the string conversion fails, notice that an unescaped, unsafe `self`…</p> https://cve.radiocsirt.org/vuln/ghsa-6jj5-j4j8-8473