Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.
References
| Link | Resource |
|---|---|
| https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.md | Exploit Third Party Advisory |
| https://leafletjs.com/ |
Configurations
History
21 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
20 Apr 2026, 16:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Leafletjs leaflet
Leafletjs |
|
| References | () http://leaflet.com - Not Applicable | |
| References | () https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:leafletjs:leaflet:*:*:*:*:*:node.js:*:* |
14 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 |
14 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-14 15:16
Updated : 2026-04-21 18:16
NVD link : CVE-2025-69993
Mitre link : CVE-2025-69993
CVE.ORG link : CVE-2025-69993
JSON object : View
Products Affected
leafletjs
- leaflet
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')