CVE-2025-69993 is a Cross-Site Scripting vulnerability in Leaflet up to version 1.9.4. The bindPopup() method fails to sanitize user-supplied input before rendering it as HTML, allowing injection of arbitrary JavaScript through event handler attributes such as onerror in image tags. This leads to script execution in the victim's browser when the popup is displayed. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium impact on confidentiality and integrity with low attack complexity and no privileges required. No official patch or remediation level has been disclosed, and no exploits are known in the wild.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when viewing a maliciously crafted popup on a Leaflet map. This can lead to information disclosure and integrity impacts within the browser context. The vulnerability requires user interaction (viewing the popup) and has a low attack complexity with no privileges required. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid rendering untrusted input via the bindPopup() method or sanitize inputs before passing them to this method. Monitor vendor channels for updates regarding patches or official mitigations.