CVE-2026-93432: Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-18 · updated 2026-10-16
Weakness: CWE-79

Description

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

Affected products

Red Hat build of Keycloak 26.4: all versions
Red Hat build of Quarkus: all versions
Red Hat Exploit Intelligence: all versions
Red Hat build of Apache Camel 4 for Quarkus 3: all versions
Red Hat build of Apicurio Registry 3: all versions
Red Hat build of Quarkus 3.27.6.redhat: all versions — fixed in 3.27.6.redhat-00004
Red Hat build of Quarkus 3.33.4.redhat: all versions — fixed in 3.33.4.redhat-00004
Red Hat Fuse 7: all versions

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004; Red Hat build of Quarkus 3.33.4.redhat 3.33.4.redhat-00004. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-93432 or the next vulnerability affects your stack