Description
A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat build of Quarkus 3.27.6.redhat
Default version status: affected
3.27.6.redhat-00004 to < *unaffected
Red Hat Red Hat build of Quarkus 3.33.4.redhat
Default version status: affected
3.33.4.redhat-00004 to < *unaffected
Red Hat Exploit Intelligence
Default version status: affected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
Default version status: affected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
Default version status: affected
Red Hat Red Hat build of Apicurio Registry 3
Default version status: affected
Red Hat Red Hat Build of Keycloak
Default version status: affected
Red Hat Red Hat Build of Keycloak
Default version status: affected
Red Hat Red Hat build of Quarkus
Default version status: affected
Red Hat Red Hat Fuse 7
Default version status: affected
Red Hat Red Hat Fuse 7
Default version status: affected