Skip to content
Sign in
6.1 Medium

CVE-2026-93432 Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

Description

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Exploit Intelligence Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Fuse 7 Versions not published
Red Hat build of Quarkus 3.27.6.redhat 3.27 earliest → < 3.27.6.redhat-00004 3.27.6.redhat-00004
Red Hat build of Quarkus 3.33.4.redhat 3.33 earliest → < 3.33.4.redhat-00004 3.33.4.redhat-00004
Red Hat Build of Apache Camel 3.33.4.redhat 3.33 earliest → < 3.33.4.redhat-00004 3.33.4.redhat-00004

Other CVEs of Exploit Intelligence

The 29 CVEs of Exploit Intelligence →
CVE-2026-121837 Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort 4.3 Medium CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 3.3 Low CVE-2026-87744 A flaw was found in Quarkus REST Data Panache 9.1 Critical
Track this CVE