CVE-2026-1337 PUBLISHED

Insufficient escaping of unicode characters in query log

Assigner: Neo4j
Reserved: 22.01.2026 Published: 06.02.2026 Updated: 06.02.2026

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.

Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
CVSS Score: 1.1

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	Low
Attack Complexity	Low	Integrity	None	Integrity	Low
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	Low
User Interaction	Active

CVSS 4.0

Product Status

Vendor	neo4j
Product	Enterprise Edition
Versions	Default: unaffected affected from 0 to 2026.01.0 (excl.)

Vendor	neo4j
Product	Community Edition
Versions	Default: unaffected affected from 0 to 2026.01.0 (excl.)

Credits

Joakim Bülow finder

References

https://github.com/JoakimBulow/CVE-2026-1337

Problem Types

CWE-117 Improper Output Neutralization for Logs CWE

Impacts

CAPEC-63 Cross-Site Scripting (XSS)
CAPEC-93 Log Injection-Tampering-Forging