CVE-2026-25148
Medium · 6.1CVSS
6.1
EPSS
0.4%
Published
Feb 3, 2026
CISA due date
—
The record
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @builder.io/qwik-city | 0 | 1.19.0 |
Related vulnerabilities
- GHSA-m6jq-g7gq-5w3c Qwik SSR XSS via Unsafe Virtual Node Serialization Same vulnerability
- GHSA-whhv-gg5v-864r Qwik City has array method pollution in FormData processing allows type confusion and DoS Also affects @builder.io/qwik-city
- CVE-2026-32701 Qwik is a performance-focused JavaScript framework. Also affects @builder.io/qwik-city
- CVE-2026-25151 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25155 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25150 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- CVE-2026-25149 Qwik is a performance focused javascript framework. Also affects @builder.io/qwik-city
- GHSA-vm6g-8r4h-22x8 Qwik City CSRF protection middleware does not work properly for content type header with… Also affects @builder.io/qwik-city