CVE-2026-27120

Name: CVE-2026-27120
Creator: NVD / NIST
Published: 2026-02-20T22:16:29.83+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.1/10EPSS 0.23%

Last modified Jun 17, 2026

CVE-2026-27120 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. EPSS estimates a 0.23% chance of exploitation in the next 30 days.

Description

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.23%

13.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Vapor	Leafkit	< 1.14.1

References

https://github.com/vapor/leaf-kit/commit/8919e39476c3a4ba05c28b71546bb9195f87ef34Patch
https://github.com/vapor/leaf-kit/security/advisories/GHSA-4hfh-fch3-5q7pExploit, Vendor Advisory

Timeline

Published: Feb 20, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-27120?

How severe is CVE-2026-27120?

CVE-2026-27120 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.

How do I fix CVE-2026-27120?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-27120?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST