LeafKit versions prior to 1.14.2 have a cross-site scripting (XSS) vulnerability due to improper HTML escaping when rendering collections (arrays or dictionaries) in templates. The vulnerability arises because LeafKit's htmlEscaped() method returns unescaped data for collections, allowing potentially untrusted input to be rendered without escaping. This can lead to XSS attacks when user-controlled data is included in arrays or dictionaries rendered via #(value) in Leaf templates.