The vulnerability in Quarkus Qute template engine arises from improper handling of content type information in the {#eval} section helper when processing sub-templates. This omission causes standard escaping mechanisms to be bypassed, resulting in untrusted input being rendered as raw, unescaped text. Consequently, this can lead to Cross-Site Scripting (XSS) and JSON Injection vulnerabilities, enabling remote attackers to execute arbitrary code in users' browsers or manipulate JSON data. The issue primarily affects applications that incorporate untrusted input within Qute templates using the {#eval} helper. The vendor advisory recommends mitigating the risk by updating templates to use the str:eval extension method instead of the vulnerable {#eval} section helper. The vulnerability has a CVSS v3.1 score of 6.1 (medium severity) and no known exploits in the wild have been reported. The vendor advisory does not explicitly confirm a patch or fixed versions but provides a mitigation workaround.

This vulnerability allows remote attackers to bypass escaping protections in the Quarkus Qute template engine, resulting in Cross-Site Scripting (XSS) and JSON Injection. The impact includes potential execution of arbitrary code in the context of a user's browser and manipulation of JSON data. This can lead to unauthorized actions such as theft of session cookies, data manipulation, or execution of malicious scripts. The severity is rated medium with low confidentiality and integrity impact and no availability impact. No known exploits have been reported in the wild.

Red Hat advises users who cannot immediately upgrade to mitigate this vulnerability by modifying their templates to replace the vulnerable {#eval} section helper with the safer str:eval extension method (i.e., use {str:eval(snippet)} instead of {#eval snippet /}). The vendor advisory does not explicitly confirm an official patch or fixed versions at this time. Users should monitor the Red Hat advisory page for updates regarding official fixes.