VULNERABILITY INTELLIGENCE

CVE-2026-1337

CVSS score5.4 MEDIUM
EPSS probability0.25%
CISA KEVNot currently listed
Published2026-02-06
Last modified2026-08-28
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit:  https://github.com/JoakimBulow/CVE-2026-1337

Weakness classification

  • 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6: CWE-117

Primary references