CVE-2026-93432

MEDIUM 6.1

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

CVSS Score

6.1

EPSS Score

0.4%

EPSS Percentile

35th

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

CWE	CWE-79
Vendor	red hat
Product	red hat build of quarkus 3.27.6.redhat
Published	Sep 18, 2026
Last Updated	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat build of quarkus 3.27.6.redhat

Be the first to know when new medium vulnerabilities affecting red hat red hat build of quarkus 3.27.6.redhat are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Red Hat / Red Hat build of Quarkus 3.27.6.redhat

All versions affected

Red Hat / Red Hat build of Quarkus 3.33.4.redhat

All versions affected

Red Hat / Exploit Intelligence

All versions affected

Red Hat / Red Hat build of Apache Camel 4 for Quarkus 3

All versions affected

Red Hat / Red Hat build of Apache Camel 4 for Quarkus 3

All versions affected

Red Hat / Red Hat build of Apicurio Registry 3

All versions affected

Red Hat / Red Hat Build of Keycloak

All versions affected

Red Hat / Red Hat Build of Keycloak

All versions affected

Red Hat / Red Hat build of Quarkus

All versions affected

Red Hat / Red Hat Fuse 7

All versions affected

Red Hat / Red Hat Fuse 7

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2026:83082 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:83520 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-93432 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2536859

Credits

Red Hat would like to thank Michael Read for reporting this issue.