A vulnerability in the Quarkus Qute template engine leads to improper output escaping when using the {#eval} section helper.
When EvalSectionHelper parses a sub-template, it fails to pass the parent template's Variant (which dictates the content type, such as HTML or JSON). Because Qute's standard escapers (HtmlEscaper, JsonEscaper) require this variant to determine if and how escaping should be applied, they silently bypass the evaluated content. As a result, any untrusted data processed inside an {#eval} block is output as raw, unescaped text.