Leaflet EUVD-2025-209449

CVSS 6.1 with CVSS:3.1/AV:N/AC:L/PR:N/S:C/C:L/I:L/A:N indicates network-accessible attack vector with low complexity and no authentication required, but requires user interaction (clicking a popup) and results in confidentiality and integrity impact with changed scope. The UX requirement (UI:R) is the primary friction point-an attacker must trick a victim into interacting with a malicious map popup. Real-world risk depends heavily on context: in applications where users control map data (crowdsourced maps, user-generated content platforms) or where attackers can inject content through URL parameters or stored data, this is a practical and immediate concern. In contrast, maps with entirely trusted, developer-controlled content face minimal risk. The vulnerability's exploitability is straightforward-no complex gadget chains or advanced techniques required-but it is not automatically exploitable across all deployments. EPSS scoring would likely reflect moderate-to-elevated probability given the simplicity of the attack pattern, but the actual priority must account for whether the affected application accepts untrusted input to bindPopup().

An attacker crafts a malicious URL or injects data into a shared map application that uses Leaflet. The URL or data includes a popup binding with an image tag containing an onerror handler: <img src=x onerror="alert('XSS')"> or more dangerously, code to exfiltrate cookies or perform actions on behalf of the logged-in user. When a victim clicks on the corresponding map feature (e.g., a marker), the popup renders with the malicious payload, the browser's HTML parser executes the onerror attribute, and the attacker's JavaScript runs with the victim's session privileges. In a stored variant, the malicious content persists in a database, affecting all users who view the map.