by Kastro
Paper/Archive/CVE-2026-25150

CVE-2026-25150

QwikDev qwik — Prototype Pollution via FormData Processing in Qwik City

EPSS 0.7%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 53.9.539 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.

Affected

ProductAffectedFixed inSource
qwik< 1.19.0–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhqrefgithub.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7