CVE-2025-69993

MEDIUM

Leaflet <= 1.9.4 - Cross-Site Scripting via bindPopup() Method

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-69993. PoCs published by PierfrancescoConti.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2025-69993, demonstrating an XSS vulnerability in Leaflet's bindPopup() method. The included Angular application allows users to input malicious HTML, which is rendered without sanitization, leading to arbitrary JavaScript execution.

Description

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session.

Exploits (1)

nomisec WORKING POC
by PierfrancescoConti · poc
https://github.com/PierfrancescoConti/leaflet-cve-2025-69993

This repository contains a functional proof-of-concept for CVE-2025-69993, demonstrating an XSS vulnerability in Leaflet's bindPopup() method. The included Angular application allows users to input malicious HTML, which is rendered without sanitization, leading to arbitrary JavaScript execution.

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Leaflet <= 1.9.4
No auth needed
Prerequisites: Leaflet library version <= 1.9.4 · User-controlled input passed to bindPopup()
devstral-2 · analyzed Apr 14, 2026 Full analysis →

Scores

CVSS v3 6.1
EPSS 0.0019
EPSS Percentile 8.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
leafletjs/leaflet < 1.9.4
Published Apr 14, 2026
Tracked Since Apr 14, 2026