CVE-2026-1337
Insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
CVE-2026-1337- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-117
- Updated
- 2026-11-02
EUVDEUVD-2026-5683
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
EUVD-2026-5683- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xr72-g735-4vwp
Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
GHSA-xr72-g735-4vwp- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-117
- Updated
- 2026-11-02
NVD
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
CVE-2026-1337- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-117
- Updated
- 2026-11-02
OSVGHSA-xr72-g735-4vwp
Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
GHSA-xr72-g735-4vwp- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-117
- Updated
- 2026-11-02
OSVBIT-neo4j-2026-1337 No score
Insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
BIT-neo4j-2026-1337- Updated
- 2026-11-02
OSVBIT-neo4j-enterprise-2026-1337 No score
Insufficient escaping of unicode characters in query log
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
- Record
BIT-neo4j-enterprise-2026-1337- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.neo4j:neo4jMaven |
before 2026.01 | 2026.01 |
neo4jBitnami |
before 2026.1.0 | 2026.1.0 |
neo4j-enterpriseBitnami |
before 2026.1.0 | 2026.1.0 |
org.neo4j:neo4jMaven |
before 2026.01, plus listed versions 1.21.2.M011.2.M021.2.M031.2.M04 Show 45 moreShow less1.2.M051.2.M061.31.3.M011.3.M021.3.M031.3.M041.3.M051.41.4.11.4.21.4.M011.4.M021.4.M031.4.M041.4.M051.4.M061.51.5.11.5.21.5.31.5.M011.5.M021.61.6.11.6.21.6.31.6.M011.6.M021.6.M031.71.7.11.7.21.7.M011.7.M021.7.M031.81.8.11.8.21.8.31.8.M011.8.M021.8.M031.8.M041.8.M05 |
2026.01 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | George0Papasotiriou/CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape | 2026-08-03 |
| PoC in GitHub | JoakimBulow/CVE-2026-1337 | 2026-02-05 |
| PoC in GitHub | primatelab/bash2shell | 2026-10-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-1337 is a low vulnerability (CVSS 1.1) in Neo4j Community Edition, published February 6, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in org.neo4j:neo4j 2026.01.
References
Left out here: 447 versions. The JSON record has them.