REDHAT-BUG-2536859: Medium severity Quarkus Qute template engine vulnerability
A vulnerability in the Quarkus Qute template engine leads to improper output escaping when using the {#eval} section helper. When EvalSectionHelper parses a sub-template, it fails to pass the parent template's Variant (which dictates the content type, such as HTML or JSON). Because Qute's standard escapers (HtmlEscaper, JsonEscaper) require this variant to determine if and how escaping should be applied, they silently bypass the evaluated content. As a result, any untrusted data processed inside an {#eval} block is output as raw, unescaped text.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Quarkus Qute templates with the {#eval} section helper are exposed when untrusted data is processed inside an evaluated sub-template. The issue is relevant where output escaping depends on the template Variant, including HTML or JSON content.
What must an attacker control for exploitation?
An attacker must be able to supply data that is rendered inside a {#eval} block. That data can then be emitted as raw, unescaped text because the evaluated sub-template does not receive the parent template's Variant.
How can teams identify potentially affected templates?
Review Qute templates for uses of {#eval} and determine whether values within those blocks can originate from untrusted input. Pay particular attention to templates intended to produce HTML or JSON, where the standard escapers depend on the Variant.