Qwik SSR XSS via Unsafe Virtual Node Serialization

Description

Description A Cross-site Scripting (CWE-79) vulnerability in Qwik.js’ server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim’s browser in the context of the affected origin.

Recommendation

Update the @builder.io/qwik-city package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.19.0
• Patched version(s): 1.19.0

References

• GHSA-m6jq-g7gq-5w3c
• CVE-2026-25148
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom - CVE-2026-34601
• Prototype Pollution via FormData Processing in Qwik City - CVE-2026-25150
• Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
• Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@builder.io/qwik-city