Threats affecting pkg:npm/qwikdev/qwik

Qwik is a performance focused javascript framework.qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

CVE-2026-25148 is a medium severity Cross-Site Scripting (XSS) vulnerability in Qwik, a JavaScript framework focused on performance. Versions prior to 1.19.0 are affected due to improper neutralization of input during server-side rendering of virtual attributes, allowing remote attackers to inject malicious scripts. Exploitation requires no authentication but does require user interaction to trigger script execution in the victim's browser within the affected origin context. This vulnerability can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the user. The issue has been patched in Qwik version 1.19.0. European organizations using affected Qwik versions in web applications are at risk, especially those with public-facing services.

CVE-2026-25151 is a Cross-Site Request Forgery (CSRF) vulnerability in QwikDev's Qwik JavaScript framework versions prior to 1.19.0. The issue arises from inconsistent interpretation of HTTP request headers, specifically Content-Type headers, by Qwik City's server-side request handler. This flaw allows remote attackers to bypass CSRF protections by crafting or using multi-valued Content-Type headers, potentially leading to unauthorized actions with elevated integrity impact. The vulnerability has a CVSS score of 5.9 (medium severity) and requires user interaction but no authentication. It affects web applications built on vulnerable Qwik versions and has no known exploits in the wild yet. The issue was patched in version 1.19.

CVE-2026-25155 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Qwik JavaScript framework versions prior to 1.12.0. The flaw stems from a typo in the regular expression used by the isContentType function, causing improper parsing of certain Content-Type headers. This parsing error can be exploited by attackers to craft malicious requests that bypass normal CSRF protections, potentially leading to unauthorized actions with high integrity impact but low confidentiality and no availability impact. The vulnerability requires user interaction and remote network access but no authentication. Although no known exploits are reported in the wild, organizations using vulnerable Qwik versions should upgrade to 1.12.0 or later. European organizations that heavily rely on Qwik for web applications, especially in countries with significant software development ecosystems, are at risk.

CVE-2026-25149 is an Open Redirect vulnerability in QwikDev's Qwik JavaScript framework versions prior to 1.19.0. The flaw exists in Qwik City's default request handler middleware, allowing attackers to redirect users to arbitrary protocol-relative URLs. Exploiting this vulnerability enables attackers to craft phishing links that appear to originate from trusted domains but redirect victims to malicious sites. The vulnerability has a low CVSS score of 2.7 and does not require user interaction or authentication. Although no known exploits are currently in the wild, unpatched systems remain at risk. The issue was patched in version 1.19.