CVE-2026-1337 – Insufficient escaping of unicode characters in query log

CVE ID : CVE-2026-1337

Published : Feb. 6, 2026, 2:16 p.m. | 1 hour, 2 minutes ago

Description : Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.

Proof of concept exploit:  https://github.com/JoakimBulow/CVE-2026-1337

Severity: 1.1 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…