{"cve":"CVE-2021-37634","nvd":{"published":"2021-08-09T20:15:07.727","modified":"2026-06-17T04:00:52.403","status":"Modified","description":"Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an attacker managed to find a variable that was rendered with their unsanitised data, they could inject scripts into a generated Leaf page, which could enable XSS attacks if other mitigations such as a Content Security Policy were not enabled. This has been patched in 1.3.0. As a workaround sanitize any untrusted input before passing it to Leaf and enable a CSP to block inline script and CSS data.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/vapor/leaf-kit-ghsa-rv3x-xq3r-8j9h/pull/1","https://github.com/vapor/leaf-kit/security/advisories/GHSA-rv3x-xq3r-8j9h","https://github.com/vapor/leaf-kit-ghsa-rv3x-xq3r-8j9h/pull/1","https://github.com/vapor/leaf-kit/security/advisories/GHSA-rv3x-xq3r-8j9h"],"products":["vapor:leafkit"],"source":"nvd","synced_at":"2026-10-19T21:21:13.713336758+00:00"},"epss":{"cve":"CVE-2021-37634","score":0.0071,"percentile":0.53553,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}