CVE-2025-69993

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.

• CWE-79

• https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.mdExploit, Third Party Advisory
• https://leafletjs.com/

Published

Apr 14, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69986A buffer overflow vulnerability exists in the ONVIF GetStrea…7.2
• CVE-2025-69988BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect A…6.5
• CVE-2025-6999An HTTP Request Smuggling [CWE-444] vulnerability in the Aut…6.9
• CVE-2025-69990phpgurukul News Portal Project V4.1 has an Arbitrary File De…9.1
• CVE-2025-69991phpgurukul News Portal Project V4.1 is vulnerable to SQL Inj…9.8
• CVE-2025-69992phpgurukul News Portal Project V4.1 has File Upload Vulnerab…9.8
• CVE-2025-7000An issue has been discovered in GitLab CE/EE affecting all v…4.3
• CVE-2025-7001An issue has been discovered in GitLab CE/EE affecting all v…2.7
• CVE-2025-7002Heap buffer out-of-bounds read vulnerability in Avira Antivi…7.8
• CVE-2025-70023An issue pertaining to CWE-843: Access of Resource Using Inc…9.8
• CVE-2025-70024An issue pertaining to CWE-89: Improper Neutralization of Sp…9.8
• CVE-2025-70025An issue pertaining to CWE-79: Improper Neutralization of In…6.1