Leafletjs

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Leafletjs records in CISA KEV

No Leafletjs vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

1 record in Leaflet · all components

TI-2025-42984 CVE-2025-69993 · GHSA-h5cx-hfj5-x8v3

MEDIUM 60

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00191 Published 2026-04-14 Fix deferred CWE-79