Moderate severityOSV Advisory· Published Feb 3, 2026· Updated Feb 4, 2026
Qwik SSR XSS via Unsafe Virtual Node Serialization
CVE-2026-25148
Description
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@builder.io/qwik-citynpm | < 1.19.0 | 1.19.0 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-m6jq-g7gq-5w3cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25148ghsaADVISORY
- github.com/QwikDev/qwik/commit/fe2d9232c0bcec99411d51a00dae29295871d094ghsax_refsource_MISCWEB
- github.com/QwikDev/qwik/security/advisories/GHSA-m6jq-g7gq-5w3cghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.