CVSS 4.0
1.1 lowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:PCVE-2026-1337
Low (1.1) in neo4j neo4j. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in org.neo4j:neo4j 2026.01.
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
Severity
CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWE
- CWE-117
- Published
- Modified
- Record from
- the NVD, synced
Affected
- neo4j:neo4j
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xr72-g735-4vwp | Maven | org.neo4j:neo4j | <2026.01 | 2026.01 |