LOW
GHSA-xr72-g735-4vwp
Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log
Quick fix
GHSA-xr72-g735-4vwp — org.neo4j:neo4j: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2026.01</version> for org.neo4j:neo4jDetails
Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.
Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.neo4j:neo4j
Introduced in:
0 Fixed in: 2026.01 Fix
# pom.xml: bump <version>2026.01</version> for org.neo4j:neo4j