CVE-2026-1337 Insufficient escaping of unicode characters in query log
Attackers can inject malicious scripts into Neo4j query logs, leading to XSS if logs are viewed in HTML-capable tools.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-1337?
CVE-2026-1337 is a low-severity cross-site scripting vulnerability in neo4j Community Edition, published on 6 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
Weakness: CWE-117
Which versions are affected by CVE-2026-1337?
4 open source packages ship an affected version, including org.neo4j:neo4j, neo4j and neo4j-enterprise. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.neo4j:neo4j Maven | All versions | 2026.01 |
org.neo4j:neo4j Maven | All versions | 2026.01 |
neo4j Bitnami | All versions | 2026.1.0 |
neo4j-enterprise Bitnami | All versions | 2026.1.0 |
Products include Neo4j Neo4j.
How do I fix CVE-2026-1337?
Upgrade org.neo4j:neo4j to 2026.01 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-1337 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1337 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in neo4j Community Edition
- CVE-2021-34371 Deserialization of Untrusted Data in Neo4j
- CVE-2018-18389 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
- CVE-2013-7259 Neo4J vulnerable to Cross-Site Request Forgery
- CVE-2024-34517 Neo4j Cypher component mishandles IMMUTABLE privileges
- CVE-2026-14587 Unathenticated connection can hold Bolt channel open
Sources
Also known as BIT-neo4j-2026-1337, BIT-neo4j-enterprise-2026-1337, GHSA-xr72-g735-4vwp, MINI-2j72-cw9j-vw22, MINI-73hp-j53f-6j47, MINI-9c4m-h2x2-hrx9 and 7 more.