CVE-2026-93432: falha de média gravidade em Red Hat Exploit Intelligence
Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 1.2%
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Red Hat · Exploit IntelligenceRed Hat · Red Hat Build of Apache Camel 3.33.4.redhatRed Hat · Red Hat build of Apache Camel 4 for Quarkus 3Red Hat · Red Hat build of Apicurio Registry 3Red Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of QuarkusRed Hat · Red Hat build of Quarkus 3.27.6.redhatRed Hat · Red Hat build of Quarkus 3.33.4.redhatRed Hat · Red Hat Fuse 7CVEs relacionadas — Red Hat Exploit Intelligence
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.4%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2026-93574MEDIUMIo.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingEPSS 1.7%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%