CVE-2026-27120 MEDIUM

CVE-2026-27120: Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

Vendor Vapor

Product leaf-kit

Weakness CWE-75

Published February 20, 2026

Last update February 24, 2026

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

Key dates

02Disclosure timeline

February 20, 2026 CVE published

February 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-27120 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/75.html