CVE-2026-1337: Insufficient escaping of unicode characters in query log

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-06 · updated 2026-08-28
Weakness: CWE-117

Description

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337

Affected products

Neo4j: before 2026.01.0 — fixed in 2026.01.0

How to fix

Upgrade to a fixed version: Neo4j 2026.01.0. Check the vendor advisory for mitigations.

References

https://github.com/JoakimBulow/CVE-2026-1337

Get alerted when CVE-2026-1337 or the next vulnerability affects your stack