Vulnerability Description
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Leafletjs | Leaflet | <= 1.9.4 |
Related Weaknesses (CWE)
References
- https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.ExploitThird Party Advisory
- https://leafletjs.com/
FAQ
What is CVE-2025-69993?
CVE-2025-69993 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing a...
How severe is CVE-2025-69993?
CVE-2025-69993 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-69993?
Check the references section above for vendor advisories and patch information. Affected products include: Leafletjs Leaflet.