5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25148

CVE-2026-25148: Qwik SSR XSS via Unsafe Virtual Node Serialization

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a victim's browser in the context of the affected origin. This issue has been patched in version 1.19.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25148

CVE-2026-25148:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@builder.io/qwik-city	npm	< 1.19.0	1.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Scripting (XSS) issue within the Qwik framework's Server-Side Rendering (SSR) logic. The root cause is the failure to properly escape dynamic data that is serialized into the HTML output. Qwik uses HTML comments to store component state and virtual node information, allowing the client-side framework to 'resume' execution. The analysis of the patch fe2d9232c0bcec99411d51a00dae29295871d094 reveals several functions that were concatenating unsanitized data directly into the rendered output.

The primary vulnerable function is renderVirtualAttributes, which constructs these state-bearing HTML comments. Before the patch, it directly included attribute values, allowing an attacker to inject a payload like --> <img src=x onerror=alert(1)> to prematurely close the comment and inject malicious HTML. Similar vulnerabilities existed in renderAttributes for standard HTML attributes, and in the handling of component key and slotName properties within renderNodeVirtual, splitProjectedChildren, and renderSSRComponent.

The fix involves consistently applying an HTML escaping function (escapeHtml and the new escapeValue wrapper) to all dynamic values before they are embedded in the server-rendered HTML, thereby neutralizing the XSS threat.

Vulnerable functions

renderVirtualAttributes

packages/qwik/src/core/render/ssr/render-ssr.ts

This function was responsible for serializing virtual node attributes into an HTML comment for server-side rendering. It directly concatenated attribute values without any escaping, allowing an attacker to provide a malicious value that could break out of the HTML comment and inject arbitrary HTML and script content. The patch fixes this by using the `escapeValue` function to sanitize the attribute values before concatenation.

renderAttributes

packages/qwik/src/core/render/ssr/render-ssr.ts

This function renders standard HTML attributes. Before the patch, it did not escape attribute values, making it vulnerable to XSS. An attacker could inject malicious content, such as event handlers, into attributes. The fix involves using the `escapeValue` function to sanitize attribute values.

renderNodeVirtual

packages/qwik/src/core/render/ssr/render-ssr.ts

This function processes virtual nodes during server-side rendering. The `node.key` property was being used without escaping. If an attacker could control the value of `node.key`, they could inject malicious content. The patch adds `escapeHtml` to sanitize the key.

splitProjectedChildren

packages/qwik/src/core/render/ssr/render-ssr.ts

This function extracts the slot name from a child component's properties. The slot name was used without being escaped, which could lead to XSS if the slot name is controlled by user input. The patch applies `escapeHtml` to the slot name.

renderSSRComponent

packages/qwik/src/core/render/ssr/render-ssr.ts

This function renders components on the server. It uses the `slotName` to project content. Since the `slotName` was not escaped, a malicious slot name could be used to inject arbitrary attributes and content into the rendered HTML. The patch ensures the slot name is escaped before being used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.