Leaflet
Monthly
Stored cross-site scripting in the Drupal Leaflet contributed module allows an authenticated user with permission to create or edit Leaflet-rendered content to persist a payload that executes in another user's browser when the affected map, popup, tooltip, or field output is displayed. The issue is rated CVSS 5.4 and affects Leaflet versions up to the 10.4.13 fix; EPSS is 0.16% (5th percentile), and no public exploit was identified at time of analysis. Remediation is a routine module update to 10.4.13 rather than emergency action.
Leaflet through version 1.9.4 allows stored or reflected cross-site scripting (XSS) via the bindPopup() method, which renders user-supplied HTML without sanitization. Network-based attackers can inject malicious JavaScript through event handler attributes in popup content, executing arbitrary code in victims' browser sessions when they interact with affected map popups. No public exploit code or active exploitation has been confirmed at this time, though the vulnerability carries a CVSS 6.1 base score reflecting moderate risk with network-accessible attack surface and user interaction requirement.
Stored cross-site scripting in the Drupal Leaflet contributed module allows an authenticated user with permission to create or edit Leaflet-rendered content to persist a payload that executes in another user's browser when the affected map, popup, tooltip, or field output is displayed. The issue is rated CVSS 5.4 and affects Leaflet versions up to the 10.4.13 fix; EPSS is 0.16% (5th percentile), and no public exploit was identified at time of analysis. Remediation is a routine module update to 10.4.13 rather than emergency action.
Leaflet through version 1.9.4 allows stored or reflected cross-site scripting (XSS) via the bindPopup() method, which renders user-supplied HTML without sanitization. Network-based attackers can inject malicious JavaScript through event handler attributes in popup content, executing arbitrary code in victims' browser sessions when they interact with affected map popups. No public exploit code or active exploitation has been confirmed at this time, though the vulnerability carries a CVSS 6.1 base score reflecting moderate risk with network-accessible attack surface and user interaction requirement.