CVE-2026-93432: Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.
Other sources
A vulnerability in the Quarkus Qute template engine leads to improper output escaping when using the {#eval} section helper. When EvalSectionHelper parses a sub-template, it fails to pass the parent template's Variant (which dictates the content type, such as HTML or JSON). Because Qute's standard escapers (HtmlEscaper, JsonEscaper) require this variant to determine if and how escaping should be applied, they silently bypass the evaluated content. As a result, any untrusted data processed inside an {#eval} block is output as raw, unescaped text.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to control to exploit this issue?
An attacker needs untrusted data to reach output generated by a Qute {#eval} section helper. Exploitation also requires a user to view or otherwise process the resulting content.
Which application outputs are at risk?
Outputs where the parent template has content-type-based escaping expectations are at risk when a sub-template is processed through {#eval}. The missing content type propagation can cause untrusted values to be emitted as raw text, enabling XSS in browser-consumed output or JSON injection in JSON output.
How can teams assess whether they may be affected?
Review Qute templates for use of the {#eval} section helper and trace whether attacker-influenced values can enter its sub-template output. Pay particular attention to templates producing HTML or JSON responses.