AIKIDO-2026-411291

drupal/leaflet is vulnerable to Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS)CVE-2026-107265 Published 6 days ago

Medium Risk

This Affects:

drupal/leaflet

0.0.1 - 10.4.12

Fixed in 10.4.13

Are you affected? Scan for Free

TL;DR

The Leaflet field formatter builds map popup and tooltip HTML in tokenResolvedContent() and passes it to Leaflet bindPopup() and bindTooltip(), which inject that string as HTML. Before 10.4.13, token replacement was run through htmlspecialchars_decode(), and an empty popup or tooltip fell back to the raw entity label. The Leaflet Views tooltip path also decoded the selected field with Html::decodeEntities(). A user who can create or edit content shown on a Leaflet map can store markup in a title or field that runs in the browser of anyone who opens the map. The fix keeps the escaping applied during token replacement, escapes the entity-label fallback with Html::escape(), and stops decoding Views tooltip fields.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and a Leaflet map popup or tooltip displays content titles or other user-controlled fields.