-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/vapor/leaf-kit | swift | < 1.3.0 | 1.3.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Leaf's core template rendering mechanism not escaping variable tags by default. The primary rendering pipeline (LeafRenderer.render) and variable resolution logic (LeafAST.Resolver.resolve) would be directly responsible for handling variable interpolation. The 1.3.0 release introduced HTML escaping by default and required explicit opt-in via UnsafeUnescapedLeafTag for raw output, indicating these core rendering functions were modified to add escaping. While exact code diffs aren't available, Leaf's architecture suggests these components handle variable processing, and the advisory explicitly mentions variable tags as the injection vector.
SwiftSwiftKEV Misses 88% of Exploited CVEs- Get the report