Drupal Leaflet CVE-2026-107265

Exploitation requires an authenticated Drupal user holding permission to create or edit content that the Leaflet module renders (map features, popups, tooltips, or associated field values), per PR:L in the CVSS vector; the stored payload then executes when another user loads the page displaying that Leaflet content. The exact field or configuration that accepts the unsanitized input is not detailed in the available sources. Limiting factors: the attacker must already have a content-submission account (not remote-unauthenticated), impact is restricted to the browser context (C:L/I:L, A:N), and only Leaflet versions up to 10.4.13 are affected - the issue is fixed in 10.4.13, which the vendor indicates is the remedy.

This is a moderate-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) in the Drupal Leaflet contributed module, and the signals are internally consistent and point to a routine, non-urgent fix rather than an active crisis. The CVSS vector requires authentication (PR:L), meaning the attacker must already hold a Drupal account with permission to submit the content that Leaflet renders; impact is limited (C:L/I:L/A:N), consistent with a stored XSS that runs in a victim's browser session. The EPSS score is very low at 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present in the input - so there is no public exploit identified at time of analysis. The vuln.today priority of 'this_month' aligns with that picture: a real but low-urgency issue to patch in normal cadence, not an emergency. One cross-signal note: the 'from 0.0.0' affected range plus a single vendor advisory means the exact injection point and whether exploitation touches a victim's session with changed scope are not detailed in the available sources - verify specifics against the Drupal SA advisory (SA-CONTRIB-2026-204).

An attacker who holds a low-privileged Drupal account with permission to create or edit content rendered by the Leaflet module submits a map feature, popup, tooltip, or field value containing a crafted script payload. The payload is stored and later executed in the browser of any user - potentially an administrator - who views the page displaying that Leaflet content, within that victim's authenticated session. No public exploit code or PoC reference is present in the input; the precise injection field is not described in the available sources.