Executive brief
Qwik City is a web framework for building fast, scalable applications. A vulnerability in its CSRF protection mechanism allows attackers to bypass security checks by manipulating HTTP Content-Type headers, potentially enabling unauthorized changes to application state. The attack requires specific CORS conditions and user interaction, but could lead to unauthorized form submissions and data modification on affected applications.
Technical details
The vulnerability exists in Qwik City's checkCSRF function, which inconsistently interprets HTTP request headers when validating Origin-based CSRF checks. An attacker can circumvent CSRF protection by crafting or sending multi-valued Content-Type headers that are processed differently by the server than expected. Exploitation requires: (1) the CORS preflight request to succeed, (2) the application to accept cross-origin requests or be accessible via non-browser clients, and (3) user interaction. The attack vector is network-based with high complexity. A successful exploit can lead to unauthorized state changes, though actual impact depends on the target application's CORS and cookie policies. The vulnerability was patched in version 1.19.0.
Affected products
- Builder.io @builder.io/qwik-city before 1.19.0
Timeline
- 2026-02-03: disclosed: Advisory published
- 2026-02-03: patched: Fixed in version 1.19.0