CVE-2026-93432

Summary

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Workarounds

Users who cannot immediately upgrade can mitigate this issue by updating their templates to use the str:eval extension method instead of the {#eval} section helper. Vulnerable pattern: {#eval snippet /} Secure alternative: {str:eval(snippet)}

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References