vapor/leaf-kit Security Advisories | GitStock

medium2026-03-16

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

GHSA-6jj5-j4j8-8473 · CVE-2026-28499

medium2026-02-19

Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

GHSA-4hfh-fch3-5q7p · CVE-2026-27120

medium2023-06-09

LeafKit allows XSS with untrusted user input

GHSA-rv3x-xq3r-8j9h · CVE-2021-37634