LeafKit HTML Escaping Vulnerability

Wed, 18 Feb 2026 10:00:00 +0000
leaf, security

LeafKit 1.14.1 fixes an XSS vulnerability where extended Unicode characters could inject malicious HTML attributes. Upgrade as soon as you can.

We’ve just released LeafKit 1.14.1 which fixes a security vulnerability that would allow XSS injection attacks by injecting unicode extended grapheme clusters into Leaf templates. Using a grapheme cluster such as "́ would bypass escaping, since Swift treats that as a single character and different to ". This caused the escaping function to skip it. HTML on the other hand parses that as two different characters and interprets the quotation mark as a closing attribute: this therefore allowed attackers to inject malicious HTML attributes and execute XSS attacks.

You can read more about it in the security advisory.

Thanks to bawolff for reporting this!