What is the CVSS score of CVE-2026-1337?

CVE-2026-1337 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Github are affected by CVE-2026-1337?

Organizations using query log in Neo4j Enterprise and Community editions should be aware of moderate risk from CVE-2026-1337 rated CVSS 5.4.. A patch is available.

Is there a public PoC exploit available for CVE-2026-1337?

Yes, a public proof-of-concept exploit is available for CVE-2026-1337. Prioritise patching immediately. EPSS: 0.0%.

Github CVE-2026-1337

MEDIUM

Improper Output Neutralization for Logs (CWE-117)

2026-02-06 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6

GHSA-xr72-g735-4vwp

XSS Github Neo4j

5.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 24, 2026 - 21:21 vuln.today

Public exploit code

CVE Published

Feb 06, 2026 - 14:16 nvd

MEDIUM 5.4

DescriptionNVD

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.

Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337

AnalysisAI

Neo4J versions up to 2026.01 contains a vulnerability that allows attackers to XSS if the user opens the logs in a tool that treats them as HTML (CVSS 5.4).

RemediationAI

Within 30 days: Identify affected systems running query log in Neo4j Enterprise and Community editions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-1337 vulnerability details – vuln.today

Back