CVE-2026-1337 LOW

CVE-2026-1337: Insufficient escaping of unicode characters in query log

Vendor Neo4J
Product Enterprise Edition
Weakness CWE-117
Published February 6, 2026
Last update February 6, 2026
View on NVD All CVEs

CVSS base score

1.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

What the vulnerability does

01Description

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit:  https://github.com/JoakimBulow/CVE-2026-1337

Key dates

02Disclosure timeline

February 6, 2026 CVE published
February 6, 2026 Record updated