CVE-2026-93432 is a moderate severity vulnerability in the Quarkus Qute template engine. The {#eval} section helper fails to pass the parent template's content type information when processing sub-templates, which bypasses escaping mechanisms. This allows untrusted input to be output as raw, unescaped text, leading to Cross-Site Scripting (XSS) and JSON Injection vulnerabilities. These issues can enable remote attackers to execute arbitrary code in users' browsers or manipulate data. The vulnerability affects applications using Qute templates that incorporate untrusted input within the {#eval} section. The vendor advisory from Red Hat recommends mitigating the issue by updating templates to use the str:eval extension method instead of the vulnerable {#eval} section helper. No explicit patch or fixed version is currently provided.

The vulnerability allows untrusted data to bypass escaping protections, resulting in Cross-Site Scripting (XSS) and JSON Injection. This can lead to remote code execution in a user's browser or unauthorized data manipulation. The impact includes potential disclosure of sensitive user information, session hijacking, and execution of malicious scripts. The flaw affects confidentiality and integrity but does not impact availability. The CVSS v3.1 score is 6.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and scope change with low confidentiality and integrity impact.

Users unable to upgrade immediately should modify their Qute templates to replace the vulnerable {#eval} section helper with the str:eval extension method (e.g., replace {#eval snippet /} with {str:eval(snippet)}). This change mitigates the vulnerability by ensuring proper escaping of untrusted data. The vendor advisory does not currently confirm an official patch or fixed version; therefore, users should monitor the vendor advisory for updates and apply official fixes when available.