Read the docs
TI-2026-01049 Aliases CVE-2026-1337GHSA-xr72-g735-4vwp

Insufficient escaping of unicode characters in query log

Priority MEDIUM 40CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit:  https://github.com/JoakimBulow/CVE-2026-1337

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Enterprise Edition (neo4j): 2026.01.0Community Edition (neo4j): 2026.01.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
neo4jEnterprise Editionbefore 2026.01.02026.01.0Patch availableCNA
neo4jCommunity Editionbefore 2026.01.02026.01.0Patch availableCNA
—org.neo4j:neo4j (Maven)before 2026.012026.01Patch availableGHSA-xr72-g735-4vwp
  • Enterprise Edition Vendorneo4j Affected before 2026.01.0 Fixed in 2026.01.0 Patch available CNA
  • Community Edition Vendorneo4j Affected before 2026.01.0 Fixed in 2026.01.0 Patch available CNA
  • org.neo4j:neo4j (Maven) Vendor— Affected before 2026.01 Fixed in 2026.01 Patch available GHSA-xr72-g735-4vwp

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:*before 2026.01.0Vulnerableneo4j
cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*before 2026.01.0Vulnerableneo4j
  • cpe:2.3:a:neo4j:neo4j:*:*:*:*:community:*:*:* Versions before 2026.01.0 Vulnerable ·neo4j
  • cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:* Versions before 2026.01.0 Vulnerable ·neo4j

Remediation

  • Fix · CNA Enterprise Edition (neo4j) Fixed in 2026.01.0
  • Fix · CNA Community Edition (neo4j) Fixed in 2026.01.0
  • Fix · GHSA-xr72-g735-4vwp org.neo4j:neo4j (Maven) Fixed in 2026.01 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1337
  2. 2026-10-03 Alias added: GHSA-xr72-g735-4vwp

References

Exploit 1

Advisory 1

Other 1

  • TI-2021-13406 Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that… CVSS 3.1CRITICAL 9.8
  • TI-2018-13005 Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9… CVSS 3.0CRITICAL 9.8
  • TI-2013-05927 Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote… CVSS 2.0MEDIUM 6.8
  • TI-2026-12296 Unathenticated connection can hold Bolt channel open CVSS 4.0MEDIUM 5.5
  • TI-2024-22827 Improper privilege management in Neo4j CVSS 3.1MEDIUM 6.5
  • TI-2026-01192 Incorrect privilege assignment in composite databases CVSS 4.0LOW 2.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences