CVE-2026-1337 - Insufficient escaping of unicode characters in query log

CVE ID : CVE-2026-1337 Published : Feb. 6, 2026, 2:16 p.m. | 14 minutes ago Description : Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit:  Severity: 1.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...