PT-2026-6724 · Neo4J · Neo4J

Joakim Bülow · Publicado 2026-02-06 · Atualizado 2026-02-26 · CVE-2026-1337

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Neo4j versions prior to 2026.01

Description A lack of proper unicode character escaping in the query log functionality can result in cross-site scripting (XSS) if logs are opened in a tool that interprets them as HTML. The issue is present in both Neo4j Enterprise and Community editions. While there is no direct security impact to Neo4j products, the advisory suggests treating logs as plain text.

Recommendations Update to version 2026.01 or later. Treat query logs as plain text if using versions prior to 2026.01.

Exploit

Correção

Enumeração de Fraquezas

CWE-117

Identificadores relacionados

BIT-NEO4J-2026-1337

CVE-2026-1337

GHSA-XR72-G735-4VWP

Produtos afetados

Neo4J

Referências · 7

• 🔥 https://github.com/JoakimBulow/CVE-2026-1337 · Exploit
• https://github.com/neo4j/neo4j · Nota
• https://osv.dev/vulnerability/CVE-2026-1337 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xr72-g735-4vwp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-1337 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-neo4j-2026-1337 · Aviso do Fabricante
• https://t.me/CVEtracker/43941 · Publicação no Telegram