Executive brief
Qwik City, a framework for building web applications, contains a vulnerability in how it processes form submissions. An attacker can send specially crafted form data to inject malicious code into the application's core object structure, bypassing authentication, escalating privileges, or crashing the service without needing credentials or user interaction.
Technical details
A prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function converts form field names with dot notation (e.g., user.name) into nested objects but fails to sanitize dangerous property names such as __proto__, constructor, and prototype. An unauthenticated, network-based attacker can send a POST request with crafted form field names to pollute Object.prototype on the server, potentially causing privilege escalation, authentication bypass, denial of service, or other application integrity failures. The vulnerability affects all versions prior to 1.19.0, which contains the fix.
Affected products
- Builder.io Qwik City < 1.19.0
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched: Fixed in version 1.19.0