Description
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.
Affected products
leafletjs: leaflet
References2
- github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/… ExploitThird Party Advisory
- leafletjs.com/
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 10 · as of 12 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.