# CVE-2026-25148: Qwik SSR XSS via unsafe virtual node serialization

Source: https://junglewise.ai/threats/cve-2026-25148-qwik-ssr-xss-via-unsafe-virtual-node-serialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25148 · Severity: medium · CVSS 4 · Published 2026-02-03

Qwik is a JavaScript framework for building server-rendered web applications. A flaw in how Qwik serializes virtual component boundaries allows attackers to inject malicious JavaScript code into server-rendered HTML pages when applications dynamically use user-controlled data in virtual node attributes. Successful exploitation results in arbitrary code execution in users' browsers.

Technologies: [@builder.io/qwik-city (npm)](https://junglewise.ai/threats/technologies/builder-io-qwik-city). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25148 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25148 being exploited in the wild.

**How severe is CVE-2026-25148?** Medium severity, with a CVSS score of 4, published 3 February 2026.

**Which products and versions are affected?** @builder.io/qwik-city (npm) SEMVER:introduced=0,fixed=1.19.0.

**Is there a fix for CVE-2026-25148?** Yes. @builder.io/qwik-city (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25148 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25148?** Check whether you run @builder.io/qwik-city (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @builder.io/qwik-city (npm): upgrade to 1.19.0 or later

  ```sh
  npm install @builder.io/qwik-city@1.19.0
  ```


## Technical details

A Cross-Site Scripting (CWE-79) vulnerability exists in Qwik's server-side rendering process when serializing virtual node attributes. The framework marks component boundaries with HTML comments and builds the comment content by concatenating attribute names and values without escaping or quoting. An attacker-controlled key or value in a virtual attribute can prematurely close the HTML comment marker and inject arbitrary HTML/JavaScript. The vulnerability only affects applications that dynamically populate virtual attributes with user-influenced data; applications using hard-coded values are unaffected. Successful exploitation permits arbitrary script execution in the victim's browser context and can desynchronize client-side hydration, leading to unexpected behavior. The vulnerability has been patched in qwik version 1.19.0.

## Affected products

- Builder.io Qwik before 1.19.0

## Identifiers

- CVE-2026-25148
- GHSA-m6jq-g7gq-5w3c

## Timeline

- 2026-02-03: disclosed: GHSA-m6jq-g7gq-5w3c published
- 2026-02-03: patched: Version 1.19.0 released with patch

## References

- [https://github.com/QwikDev/qwik/security/advisories/GHSA-m6jq-g7gq-5w3c](https://github.com/QwikDev/qwik/security/advisories/GHSA-m6jq-g7gq-5w3c)

## Related threats

- [Builder.io Qwik City array method pollution in FormData parsing](https://junglewise.ai/threats/cve-2026-32701-builder-io-qwik-city-array-method-pollution-in-formdata-parsing)
- [Qwik City CSRF protection middleware regex parsing bypass](https://junglewise.ai/threats/cve-2026-25155-qwik-city-csrf-protection-middleware-regex-parsing-bypass)
- [Qwik City open redirect in fixTrailingSlash middleware](https://junglewise.ai/threats/cve-2026-25149-qwik-city-open-redirect-in-fixtrailingslash-middleware)
- [Qwik City CSRF bypass via Content-Type header validation](https://junglewise.ai/threats/cve-2026-25151-qwik-city-csrf-bypass-via-content-type-header-validation)
- [Builder.io Qwik City prototype pollution in form processing](https://junglewise.ai/threats/cve-2026-25150-builder-io-qwik-city-prototype-pollution-in-form-processing)