{"id":"CVE-2026-93432","aliases":["EUVD-2026-83259","GHSA-6wxq-x76c-fqrf"],"status":"published","title":"Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus","description":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01183,"percentile":0.68168,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-18T17:53:19Z","modified":"2026-11-06T06:36:34Z","products":[{"vendor":"red hat","product":"exploit intelligence"},{"vendor":"red hat","product":"red hat build of apache camel 3.33.4.redhat"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of quarkus"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.6.redhat"},{"vendor":"red hat","product":"red hat build of quarkus 3.33.4.redhat"},{"vendor":"red hat","product":"red hat fuse 7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:83082","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83670","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93432","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536859","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93432"},{"url":"https://github.com/advisories/GHSA-6wxq-x76c-fqrf"}],"sources":{"cve":[{"id":"CVE-2026-93432","title":"Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus","description":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","status":"published","published":"2026-09-18T17:53:19.772Z","modified":"2026-11-06T06:36:34.691Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T07:27:10.786819Z"}],"euvd":[{"id":"EUVD-2026-83259","description":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","status":"published","published":"2026-09-18T17:53:19Z","modified":"2026-11-06T06:36:34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T08:04:05.441568Z"}],"ghsa":[{"id":"GHSA-6wxq-x76c-fqrf","title":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a...","description":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","status":"published","published":"2026-09-18T18:31:44Z","modified":"2026-11-06T09:32:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T09:59:38.586951Z"}],"nvd":[{"id":"CVE-2026-93432","description":"A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.","status":"published","published":"2026-09-18T18:18:26.27Z","modified":"2026-11-06T07:18:00.977Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T11:59:57.419913Z"}]}}