CVE-2025-69993

This repository is a legitimate proof-of-concept for CVE-2025-69993, describing an XSS issue in Leaflet <= 1.9.4 when applications pass untrusted content directly to bindPopup(). It is not an automated remote exploit against a network service; instead, it is a browser/web exploit demonstration showing how unsafe application usage of Leaflet leads to arbitrary JavaScript execution. Repository structure: the root contains documentation files (README.md, ADVISORY.md) and a self-contained Angular demo application under leaflet-xss-poc/. The Angular project includes standard configuration files (angular.json, tsconfig*.json, package.json), UI template/styling (src/app/app.html, app.scss), bootstrap code (src/main.ts, app.config.ts), and the main vulnerable logic in src/app/app.ts. Core exploit behavior: the app renders a map, accepts user-controlled popupDescription input from a textarea, and on Add Marker creates a Leaflet marker whose popup content is set directly via .bindPopup(popupContent) with no sanitization. Because Leaflet renders the string as HTML, payloads such as <img src=x onerror="alert('XSS')"> execute in the browser when the popup opens. The demo also documents alternative payloads including SVG onload and simulated cookie exfiltration. Main exploit capabilities: browser-side JavaScript execution in the context of the vulnerable application; demonstration of stored/reflected XSS conditions; potential follow-on impacts such as cookie theft, phishing UI injection, session abuse, and exfiltration if adapted to a real target. The code itself does not include persistence, scanning, delivery, or post-exploitation automation. Notable implementation details: initMap() configures remote Leaflet marker assets from unpkg.com and map tiles from tile.openstreetmap.org. addMarkerWithPopup() is the key vulnerable function. The app is intended to be run locally with npm start and viewed at http://localhost:4200/.