CVE-2026-25148

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.

Published Feb 4, 2026

https://github.com/QwikDev/qwik/security/advisories/GHSA-m6jq-g7gq-5w3c

CVSS ScoreMedium

6.1

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2026-25148

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.

Published Feb 4, 2026

https://github.com/QwikDev/qwik/security/advisories/GHSA-m6jq-g7gq-5w3c

CVSS ScoreMedium

6.1


npm	@builder.io/qwik	0.0.100-dev20220820024200
npm	@builder.io/qwik	0.0.100
npm	@builder.io/qwik	0.0.101
npm	@builder.io/qwik	0.0.102
npm	@builder.io/qwik	0.0.103
npm	@builder.io/qwik	0.0.104
npm	@builder.io/qwik	0.0.105
npm	@builder.io/qwik	0.0.106
npm	@builder.io/qwik	0.0.107-dev20220902034212
npm	@builder.io/qwik	0.0.107-dev20220902195306
npm	@builder.io/qwik	0.0.107
npm	@builder.io/qwik	0.0.108-dev20220913212706
npm	@builder.io/qwik	0.0.108-dev20220913220811
npm	@builder.io/qwik	0.0.108-dev20220914022956
npm	@builder.io/qwik	0.0.108-dev20220914040446
npm	@builder.io/qwik	0.0.108-dev20220916152030
npm	@builder.io/qwik	0.0.108
npm	@builder.io/qwik	0.0.109
npm	@builder.io/qwik	0.0.110
npm	@builder.io/qwik	0.0.112
npm	@builder.io/qwik	0.0.113
npm	@builder.io/qwik	0.0.39-dev20220805031634
npm	@builder.io/qwik	0.0.39
npm	@builder.io/qwik	0.0.40-0-dev20220808233008
npm	@builder.io/qwik	0.0.40
npm	@builder.io/qwik	0.0.41
npm	@builder.io/qwik	0.0.42
npm	@builder.io/qwik	0.10.0
npm	@builder.io/qwik	0.100.0-dev20230330193227
npm	@builder.io/qwik	0.100.0
npm	@builder.io/qwik	0.101.0
npm	@builder.io/qwik	0.102.0
npm	@builder.io/qwik	0.103.0-dev20230420165851
npm	@builder.io/qwik	0.103.0-dev20230421164933
npm	@builder.io/qwik	0.103.0-dev20230425141617
npm	@builder.io/qwik	0.103.0
npm	@builder.io/qwik	0.104.0-dev20230426063745
npm	@builder.io/qwik	0.104.0-dev20230426103638
npm	@builder.io/qwik	0.104.0
npm	@builder.io/qwik	0.105.0-dev20230428060946
npm	@builder.io/qwik	0.105.0
npm	@builder.io/qwik	0.106.0
npm	@builder.io/qwik	0.107.0
npm	@builder.io/qwik	0.11.0
npm	@builder.io/qwik	0.11.1-dev20221020161056
npm	@builder.io/qwik	0.11.1-dev20221020180233
npm	@builder.io/qwik	0.11.1-dev20221021092556
npm	@builder.io/qwik	0.11.1-dev20221021131556
npm	@builder.io/qwik	0.11.1
npm	@builder.io/qwik	0.12.0-dev20221021194131

Ecosystem	Package	Version


npm	@builder.io/qwik	0.0.100-dev20220820024200
npm	@builder.io/qwik	0.0.100
npm	@builder.io/qwik	0.0.101
npm	@builder.io/qwik	0.0.102
npm	@builder.io/qwik	0.0.103
npm	@builder.io/qwik	0.0.104
npm	@builder.io/qwik	0.0.105
npm	@builder.io/qwik	0.0.106
npm	@builder.io/qwik	0.0.107-dev20220902034212
npm	@builder.io/qwik	0.0.107-dev20220902195306
npm	@builder.io/qwik	0.0.107
npm	@builder.io/qwik	0.0.108-dev20220913212706
npm	@builder.io/qwik	0.0.108-dev20220913220811
npm	@builder.io/qwik	0.0.108-dev20220914022956
npm	@builder.io/qwik	0.0.108-dev20220914040446
npm	@builder.io/qwik	0.0.108-dev20220916152030
npm	@builder.io/qwik	0.0.108
npm	@builder.io/qwik	0.0.109
npm	@builder.io/qwik	0.0.110
npm	@builder.io/qwik	0.0.112
npm	@builder.io/qwik	0.0.113
npm	@builder.io/qwik	0.0.39-dev20220805031634
npm	@builder.io/qwik	0.0.39
npm	@builder.io/qwik	0.0.40-0-dev20220808233008
npm	@builder.io/qwik	0.0.40
npm	@builder.io/qwik	0.0.41
npm	@builder.io/qwik	0.0.42
npm	@builder.io/qwik	0.10.0
npm	@builder.io/qwik	0.100.0-dev20230330193227
npm	@builder.io/qwik	0.100.0
npm	@builder.io/qwik	0.101.0
npm	@builder.io/qwik	0.102.0
npm	@builder.io/qwik	0.103.0-dev20230420165851
npm	@builder.io/qwik	0.103.0-dev20230421164933
npm	@builder.io/qwik	0.103.0-dev20230425141617
npm	@builder.io/qwik	0.103.0
npm	@builder.io/qwik	0.104.0-dev20230426063745
npm	@builder.io/qwik	0.104.0-dev20230426103638
npm	@builder.io/qwik	0.104.0
npm	@builder.io/qwik	0.105.0-dev20230428060946
npm	@builder.io/qwik	0.105.0
npm	@builder.io/qwik	0.106.0
npm	@builder.io/qwik	0.107.0
npm	@builder.io/qwik	0.11.0
npm	@builder.io/qwik	0.11.1-dev20221020161056
npm	@builder.io/qwik	0.11.1-dev20221020180233
npm	@builder.io/qwik	0.11.1-dev20221021092556
npm	@builder.io/qwik	0.11.1-dev20221021131556
npm	@builder.io/qwik	0.11.1
npm	@builder.io/qwik	0.12.0-dev20221021194131

Find vulnerabilities. Fix fast with AI.

CVE-2026-25148

CVE-2026-25148