| Package | Affected versions | Patched versions |
|---|---|---|
| leaflet | ≤ 1.9.4 |
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free