Executive brief
Qwik is a JavaScript framework for building server-rendered web applications. A flaw in how Qwik serializes virtual component boundaries allows attackers to inject malicious JavaScript code into server-rendered HTML pages when applications dynamically use user-controlled data in virtual node attributes. Successful exploitation results in arbitrary code execution in users' browsers.
Technical details
A Cross-Site Scripting (CWE-79) vulnerability exists in Qwik's server-side rendering process when serializing virtual node attributes. The framework marks component boundaries with HTML comments and builds the comment content by concatenating attribute names and values without escaping or quoting. An attacker-controlled key or value in a virtual attribute can prematurely close the HTML comment marker and inject arbitrary HTML/JavaScript. The vulnerability only affects applications that dynamically populate virtual attributes with user-influenced data; applications using hard-coded values are unaffected. Successful exploitation permits arbitrary script execution in the victim's browser context and can desynchronize client-side hydration, leading to unexpected behavior. The vulnerability has been patched in qwik version 1.19.0.
Affected products
- Builder.io Qwik before 1.19.0
Timeline
- 2026-02-03: disclosed: GHSA-m6jq-g7gq-5w3c published
- 2026-02-03: patched: Version 1.19.0 released with patch