CVE-2026-1337

CVE-2026-1337 describes a cross-site scripting (XSS) vulnerability in Neo4j Enterprise and Community editions prior to version 2026.01, stemming from insufficient escaping of Unicode characters in query logs. An attacker could exploit this by crafting malicious input that, when logged, would execute XSS if an administrator viewed the logs in a tool that interprets them as HTML. Rated as MEDIUM severity with a CVSS score of 5.4, this vulnerability requires user interaction (UI:R) and low privileges (PR:L) for exploitation, with a potential impact of low confidentiality and integrity. There is no evidence of active exploitation, no known Metasploit or ExploitDB modules, and minimal community discussion or media coverage, indicating a low current threat landscape.