Neo4j Community and Enterprise editions that log queries before the 2026.01 release do not properly escape Unicode characters in the query log. This deficiency means that if a log file is opened with a tool that renders its contents as HTML, an attacker can embed malicious scripts that will execute in the viewer’s context. The vulnerability is a classic case of unchecked input validation, identified as CWE‑117, and the impact is limited to the environment that consumes the logs rather than the Neo4j database itself.

The flaw affects all Neo4j Community Edition and Enterprise Edition installations released prior to 2026.01. No specific release numbers are listed, so any version before the 2026.01 milestone is potentially vulnerable.

The CVSS score of 1.1 and an EPSS score of less than 1% indicate that the vulnerability poses a low overall risk and is unlikely to be widely exploited. Because exploitation requires a client that parses logs as HTML, an attacker would need local or remote access to a log‑viewing environment, making the attack vector environment‑dependent rather than network‑based. The vulnerability is not catalogued in the CISA Known Exploited Vulnerabilities list, further suggesting a minimal threat level when logs are treated as plain text.