Varixo

4 exploits Active since Feb 2026
CVE-2026-25148 WRITEUP MEDIUM WRITEUP
Qwik < 1.19.0 - Cross-Site Scripting via Virtual Attribute Serialization
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.
CVSS 6.1
CVE-2026-25149 WRITEUP MEDIUM WRITEUP
Qwik < 1.19.0 - Open Redirect via Default Request Handler Middleware
Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.
CVSS 6.1
CVE-2026-25150 WRITEUP CRITICAL WRITEUP
Qwik and Qwik City < 1.19.0 - Unauthenticated Prototype Pollution via formToObj Function
Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0.
CVSS 9.3
CVE-2026-25151 WRITEUP MEDIUM WRITEUP
Qwik and Qwik City < 1.19.0 - Cross-Site Request Forgery via Crafted Content-Type Header
Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This issue has been patched in version 1.19.0.
CVSS 5.9