Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 14, 2026 · NIST NVD

   Detected

   Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., ). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser

2. Jun 17, 2026 · NIST NVD

   Updated

   Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., ). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser

Affected

• cpe leafletjs/leafletversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-69993

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-69993

  Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e

  nvd.nist.gov

References

• Exploit · github.com
• Reference · leafletjs.com