6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27120

CVE-2026-27120: Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27120

CVE-2026-27120:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
leaf-kit	swift	< 1.4.1	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the htmlEscaped function within the leaf-kit library. The root cause is the incorrect use of string replacement functions (replacing and replacingOccurrences) that operate on Swift's extended grapheme clusters rather than on individual Unicode characters. This allows an attacker to bypass HTML entity escaping by sending a malicious string where a special HTML character (e.g., ") is part of a larger grapheme cluster (e.g., " + combining accent \u{0301}). The vulnerable function, String.htmlEscaped, would not recognize this cluster as a simple double quote and would fail to escape it, leading to a potential Cross-Site Scripting (XSS) vulnerability when the string is rendered in an HTML attribute. The provided patch confirms this analysis by replacing the grapheme-based replacement with a safer method that iterates over the string's unicodeScalars, effectively treating each part of the grapheme cluster as an individual character for escaping purposes.

Vulnerable functions

String.htmlEscaped

Sources/LeafKit/String+HTMLEscape.swift

The vulnerability lies in the `htmlEscaped()` function, which is an extension on Swift's `String` type. The original implementation used `replacingOccurrences(of:with:)` or `replacing(_:with:)`, which operate on extended grapheme clusters. An attacker could bypass the HTML escaping by crafting a string where a special character (like a double quote) is combined with a Unicode combining character. This combination forms a single grapheme cluster that is not recognized as the special character alone, thus avoiding replacement. The fix iterates over the string's `unicodeScalars`, ensuring that each Unicode scalar is checked individually, which correctly identifies and escapes the special characters regardless of grapheme clustering.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.