CVE-2025-69993

OVERVIEW CVE-2025-69993 is a Cross-Site Scripting (XSS) vulnerability affecting Leaflet mapping library versions up to and including 1.9.4. The flaw exists in the bindPopup() method, which fails to sanitize user-supplied input before rendering it as raw HTML. This allows attackers to inject malicious JavaScript code through event handler attributes that execute when victims view the affected map popup. SEVERITY The vulnerability carries a CVSS score of 6.1 (Medium severity) with network-based attack vector, low attack complexity, and no authentication requirements. Exploitation requires user interaction (displaying the popup), but impacts are cross-site in nature, potentially affecting confidentiality and integrity of the victim's browser session. The attack does not require elevated privileges, making it relatively accessible to threat actors. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat intelligence tracking services. The EPSS score of 0.0003 indicates minimal observed exploitation activity compared to other known vulnerabilities. No widespread public exploit code or active community attention has been documented, suggesting limited real-world weaponization at this time.