PT-2026-6724 · Neo4J · Neo4J

Joakim Bülow · Published 2026-02-06 · Updated 2026-02-26 · CVE-2026-1337

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Neo4j versions prior to 2026.01

Description A lack of proper unicode character escaping in the query log functionality can result in cross-site scripting (XSS) if logs are opened in a tool that interprets them as HTML. The issue is present in both Neo4j Enterprise and Community editions. While there is no direct security impact to Neo4j products, the advisory suggests treating logs as plain text.

Recommendations Update to version 2026.01 or later. Treat query logs as plain text if using versions prior to 2026.01.

Exploit

Fix

Weakness Enumeration

CWE-117

Related Identifiers

BIT-NEO4J-2026-1337

CVE-2026-1337

GHSA-XR72-G735-4VWP

Affected Products

Neo4J

References · 7

• 🔥 https://github.com/JoakimBulow/CVE-2026-1337 · Exploit
• https://osv.dev/vulnerability/CVE-2026-1337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr72-g735-4vwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1337 · Security Note
• https://osv.dev/vulnerability/BIT-neo4j-2026-1337 · Vendor Advisory
• https://github.com/neo4j/neo4j · Note
• https://t.me/CVEtracker/43941 · Telegram Post