LeafKit Lack of HTML Escaping Vulnerability

Fri, 13 Mar 2026 21:00:00 +0000
leaf, security

LeafKit 1.14.2 fixes a vulnerability where HTML escaping wasn't applied to Leaf variable substitutions, allowing XSS. Upgrade as soon as possible.

We’ve just released LeafKit 1.14.2, which addresses a security vulnerability where HTML escaping was not being applied to Leaf variable substitutions which addressed array or dictionary data. This allowed for XSS attacks if the content of such data was at least partially under user control.

Additional information is available in the security advisory.

Thanks to iCMDDev for reporting this issue!