Serguey Asael Shinder: The Qute escaping bug was a lost content type, not a missing escape call
Quarkus published GHSA-9qp9-6p5x-rfh4 / CVE-2026-93432 on 22 September 2026 at https://github.com/quarkusio/quarkus/security/advisories/GHSA-9qp9-6p5x-rfh4 — medium severity, CVSS 3.1 score 6.1, vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, filed under CWE-79, CWE-113 and CWE-116. The affected artefact is io.quarkus.qute:qute-core.
The mechanism is worth reading in the advisory's own words:
"When
EvalSectionHelperparses a sub-template, it fails to pass the parent template's Variant (which dictates the content type, such as HTML or JSON). Because Qute's standard escapers (HtmlEscaper,JsonEscaper) require this variant to determine if and how escaping should be applied, they silently bypass the evaluated content."
So nothing forgot to call an escaper. The escapers ran. They were asked to escape a value whose destination they could no longer see, and the correct behaviour of an escaper that does not know the content type is to do nothing.
The consequences follow from the destination, not from the value: rendered as HTML the evaluated content can carry <script> tags or attributes, and rendered as JSON it can inject structural characters and manipulate top-level keys. The advisory is explicit that the defect is specific to the {#eval} section helper, and that the similarly named string extension str:eval propagates the variant correctly and is not affected — which is also the workaround for anyone who cannot upgrade: {str:eval(snippet)} in place of {#eval snippet /}.
Patched versions named by the advisory: 3.39.5, 3.33.4 and 3.27.6.
The release timing, measured rather than assumed
The advisory went public on 22 September. All three patched tags were created on 23 September: 3.33.4 at 06:42 UTC, 3.27.6 at 07:05 UTC, 3.39.5 at 10:22 UTC. Only 3.39.5 has a release page — published at 17:00 UTC, at https://github.com/quarkusio/quarkus/releases/tag/3.39.5. Checked this evening, the GitHub releases API returns 404 for the 3.33.4 and 3.27.6 tags: the tags exist, the release notes do not yet.
That is the practical detail for anyone who monitors releases rather than advisories. For about a day, the fixed version existed as a number in a security advisory and not as a release you could see on the project's releases page. A team watching the releases feed learned about this later than a team watching the advisory feed — and for two of the three streams, at the time of writing, it has not appeared in that feed at all.
And the line next to it in the same changelog
The 3.39.5 changelog is a flat list of pull requests. Two of its entries:
#56831— Qute: EvalSectionHelper and StrEvalNamespaceResolver fixes#56861— Fix path normalization bypass on wildcard routes (matrix-param + dot-segment)
The first is the CVE above. Neither line says security, CVE, or advisory.
The second has no advisory of its own. The repository's advisory list holds nine advisories in total, and the only path-normalization entry among them is https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v (CVE-2026-50559, high, CVSS 7.5) from 17 June 2026 — encoded semicolons smuggling matrix parameters past AbstractPathMatchingHttpSecurityPolicy, which that advisory itself describes as distinct from the earlier CVE-2026-39852 that had addressed only literal semicolon stripping. Today's entry is the third round in the same area, and it arrives as an ordinary bullet.
What to take from it
The two bugs are one shape. In the Qute case a value crossed into a sub-template and the information about where it would end up was dropped on the way. In the path case a value crossed from the security layer into the routing layer and the two normalised it differently. Both are about a boundary that carried the value and lost the context needed to interpret it, and in both the individual components behaved exactly as documented.
Your dependency's changelog is not a security feed, and neither is its releases page. The advisory named its patched versions a day before they were visible as releases, and the release that eventually appeared described its own CVE fix as "fixes". If a CVE has to reach you before your next routine upgrade does, subscribe to https://github.com/quarkusio/quarkus/security/advisories and to the GitHub Advisory Database entry for the Maven coordinate, not to release notes.
⚠️ There is no JDK on the machine this was written on, so nothing here was built or run. The mechanism, severity, vector, affected coordinate and patched versions are quoted from the advisory linked above; the tag and release timestamps were read from the GitHub API on the evening of 23 September 2026 and are reproduced with the times measured.