How severe is CVE-2026-27120?

CVE-2026-27120 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-27120 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-27120?

CVE-2026-27120 affects Vapor Leafkit. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-27120?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-27120 have an EU (EUVD) identifier?

Yes. CVE-2026-27120 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7783.

When was CVE-2026-27120 published?

CVE-2026-27120 was published on 2026-02-20 and last updated on 2026-06-17.

CVE-2026-27120

CVE-2026-27120 is a medium-severity vulnerability in Vapor Leafkit with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-75.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 0% (14th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-7783
Weakness: CWE-75
Affected product: Vapor Leafkit
Published: 2026-02-20
Last modified: 2026-06-17

Description

Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.

Frequently asked questions

What is CVE-2026-27120?: Leafkit is a templating language with Swift-inspired syntax. Prior to 1.4.1, htmlEscaped in leaf-kit will only escape html special characters if the extended grapheme clusters match, which allows bypassing escaping by using an extended grapheme cluster containing both the special html character and some additional characters. In the case of html attributes, this can lead to XSS if there is a leaf variable in the attribute that is user controlled. This vulnerability is fixed in 1.4.1.
How severe is CVE-2026-27120?: CVE-2026-27120 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-27120 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (14th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-27120?: CVE-2026-27120 affects Vapor Leafkit. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-27120?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-27120 have an EU (EUVD) identifier?: Yes. CVE-2026-27120 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-7783.
When was CVE-2026-27120 published?: CVE-2026-27120 was published on 2026-02-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:vapor:leafkit:*:*:*:*:*:*:*:*

More vulnerabilities in Vapor Leafkit

CVE-2021-37634 — High (CVSS 7.4): Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site…
CVE-2026-28499 — Medium (CVSS 6.1): LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work…

All CVEs affecting Vapor Leafkit →

Other CWE-75 vulnerabilities

CVE-2026-29042 — Critical (CVSS 9.8): Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell…
CVE-2025-50213 — Critical (CVSS 9.8): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow…
CVE-2024-35373 — Critical (CVSS 9.8): Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.
CVE-2021-22910 — Critical (CVSS 9.8): A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an…
CVE-2021-22911 — Critical (CVSS 9.8): A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to…
CVE-2026-31908 — Critical (CVSS 9.1): Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in…

Browse all CWE-75 vulnerabilities →