Executive brief
The Quarkus Qute template engine, used to render dynamic web content, contains a flaw in its {#eval} section helper that fails to properly escape untrusted data. This allows attackers to inject arbitrary JavaScript code that executes in users' browsers or manipulate JSON data, potentially leading to session hijacking, credential theft, or account compromise.
Technical details
The vulnerability is a cross-site scripting (XSS) and JSON injection flaw in the Qute {#eval} section helper that fails to pass parent template content type information when processing sub-templates, bypassing escaping mechanisms. An unauthenticated remote attacker can craft malicious input that is rendered as raw, unescaped text in the application's web output. Mitigation is available by switching from the {#eval} section syntax to the str:eval extension method.
Affected products
- Red Hat Quarkus <UNKNOWN>
Timeline
- 2026-09-18: disclosed