CVE-2026-93432
Medium
Description
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Quarkus 3.27
PublishedSep 18, 2026
First seenSep 18, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| quarkus 3.27 | No range specified | — |
| quarkus 3.33 | No range specified | — |
| Red Hat Exploit Intelligence | No range specified | — |
| Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 | No range specified | — |
| Red Hat Red Hat build of Apicurio Registry 3 | No range specified | — |
| Red Hat Red Hat Build of Keycloak | No range specified | — |
| Red Hat Red Hat build of Quarkus | No range specified | — |
| Red Hat Red Hat Fuse 7 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.