CERT24GHSA-6wxq-x76c-fqrf: Insufficient output escaping in the Quarkus Qute template engineLoading data…
CERT24Threat Observatory
Period

GHSA-6wxq-x76c-fqrf: Insufficient output escaping in the Quarkus Qute template engine

A flaw was identified in the Quarkus Qute template engine: when processing a sub-template, the {#eval} section helper does not pass the parent template’s content-type information. This can bypass standard escaping mechanisms and allow untrusted data to be emitted as raw text.

← Back to intelligence

GHSA-6wxq-x76c-fqrf: Insufficient output escaping in the Quarkus Qute template engine

A flaw was identified in the Quarkus Qute template engine: when processing a sub-template, the {#eval} section helper does not pass the parent template’s content-type information. This can bypass standard escaping mechanisms and allow untrusted data to be emitted as raw text.