leaflet-cve-2025-69993

CVE-2025-69993 — XSS in Leaflet bindPopup Cross-Site Scripting vulnerability in Leaflet = 1.9.4. The bindPopup method renders user-supplied input as raw HTML without sanitization, allowing arbitrary JavaScript execution. Repository Structure ADVISORY.md — Full security advisory with vulnerability...

CVE-2025-69993

A flaw was found in Leaflet. This Cross-Site Scripting XSS vulnerability exists in the bindPopup method, which fails to sanitize user-supplied input. A remote attacker can exploit this by injecting malicious JavaScript code into map popups. When a victim views an affected map, the injected script...

EUVD-2025-209449

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...

DEBIAN-CVE-2025-69993

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...

CVE-2025-69993

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...

CVE-2025-69993: Improper Neutralization of Input During Web Page Generation

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...

Leaflet security vulnerabilities

Leaflet is a lightweight interactive map development library developed by Volodymyr Agafonkin. Versions of Leaflet 1.9.4 and earlier contain security vulnerabilities; these vulnerabilities stem from the bindPopup method not properly cleaning user input, which may lead to cross-site scripting...

CVE-2025-69993

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...

CVE-2025-69993

Leaflet up to v1.9.4 is affected by Cross‑Site Scripting via bindPopup(), where user input is rendered as raw HTML without sanitization, enabling injected JavaScript through event handler attributes (e.g., ) to execute in a victim’s browser session. A Proof‑of‑Concept exploit is available at the ...

CVE-2025-69993

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...

PT-2026-32628

Name of the Vulnerable Software and Affected Versions Leaflet versions prior to 1.9.5 Description Cross-Site Scripting XSS occurs via the bindPopup function. This function renders user-supplied input as raw HTML without sanitization, which allows the injection of arbitrary JavaScript code through...