CVE-2026-1337lowCWE-117

CVE-2026-1337: fallo de gravedad baja en neo4j Community Edition

Insufficient escaping of unicode characters in query log

Publicada el

Seguir esta CVE+ Monitorear Enterprise+ Monitorear Community

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 1.1epss 0.2%
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit:  https://github.com/JoakimBulow/CVE-2026-1337
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
Productos afectados
neo4j · Community Editionneo4j · Enterprise Edition
CVEs relacionadas — neo4j Community Edition

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-14587MEDIUMUnathenticated connection can hold Bolt channel openEPSS 0.5%CVE-2025-12738LOWEnumeration of restricted property valueEPSS 0.4%CVE-2026-1524LOWAuth misconfiguration when multiple providers enabledEPSS 0.4%CVE-2025-11602MEDIUMUntargeted information leak in Bolt protocol handshakeEPSS 0.3%CVE-2026-1497LOWIncorrect privilege assignment in composite databasesEPSS 0.3%CVE-2026-1622MEDIUMUnredacted data exposure in query.logEPSS 0.2%