CVE-2026-25150

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25150", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.821Z", "datePublished": "2026-02-03T21:12:50.417Z", "dateUpdated": "2026-02-04T16:31:46.643Z"}, "containers": {"cna": {"title": "Prototype Pollution via FormData Processing in Qwik City", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq"}, {"name": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7", "tags": ["x_refsource_MISC"], "url": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7"}], "affected": [{"vendor": "QwikDev", "product": "qwik", "versions": [{"version": "< 1.19.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T21:12:50.417Z"}, "descriptions": [{"lang": "en", "value": "Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0."}], "source": {"advisory": "GHSA-xqg6-98cw-gxhq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T16:31:38.732304Z", "id": "CVE-2026-25150", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:31:46.643Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25150", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T16:31:38.732304Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:31:43.188Z"}}], "cna": {"title": "Prototype Pollution via FormData Processing in Qwik City", "source": {"advisory": "GHSA-xqg6-98cw-gxhq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "QwikDev", "product": "qwik", "versions": [{"status": "affected", "version": "< 1.19.0"}]}], "references": [{"url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq", "name": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7", "name": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T21:12:50.417Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25150", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:31:46.643Z", "dateReserved": "2026-01-29T15:39:11.821Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T21:12:50.417Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "qwik", "vendor": "QwikDev", "versions": [{"status": "affected", "version": "< 1.19.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "8A329D09-A8EB-4297-8BD9-4E862179FE54", "versionEndExcluding": "1.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangerous property names like __proto__, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. This issue has been patched in version 1.19.0."}, {"lang": "es", "value": "Qwik es un framework de javascript centrado en el rendimiento. Antes de la versi\u00f3n 1.19.0, existe una vulnerabilidad de contaminaci\u00f3n de prototipos en la funci\u00f3n formToObj() dentro del middleware @builder.io/qwik-city. La funci\u00f3n procesa los nombres de los campos del formulario con notaci\u00f3n de puntos (por ejemplo, user.name) para crear objetos anidados, pero no logra sanear nombres de propiedades peligrosos como __proto__, constructor y prototype. Esto permite a atacantes no autenticados contaminar Object.prototype enviando solicitudes HTTP POST manipuladas, lo que podr\u00eda conducir a escalada de privilegios, omisi\u00f3n de autenticaci\u00f3n o denegaci\u00f3n de servicio. Este problema ha sido parcheado en la versi\u00f3n 1.19.0."}], "id": "CVE-2026-25150", "lastModified": "2026-06-17T10:24:11.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25150", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T16:31:38.732304Z", "version": "2.0.3"}}]}, "published": "2026-02-03T22:16:30.690", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:08:39.100571+00:00", "value": {"mitigation_remediation": ["Upgrade The Qwik framework to version 1.19.0 or later, which applies the fix for the formToObj() prototype\u2011pollution issue.", "If upgrading is not immediately possible, apply the patch found in the GitHub commit 5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7 or merge the corresponding changes to sanitize __proto__, constructor, and prototype keys.", "Limit or disable the use of the @builder.io/qwik-city middleware on publicly exposed routes, or restrict POST requests via access controls or rate limiting to reduce the attack surface."], "summary": {"action": "Immediate Patch", "impact": "Prototype Pollution enabling privilege escalation, authentication bypass, or denial of service"}, "threat_synthesis": {"affected_systems": "The flaw affects QwikDev's Qwik framework, specifically the @builder.io/qwik-city middleware. Any instance running a version prior to 1.19.0 is vulnerable. Users employing older Qwik releases in production should verify if their code imports and uses this middleware.", "description_and_impact": "The vulnerability is a prototype\u2011pollution flaw in the Qwik framework's formToObj() function, which processes form field names with dot notation. It does not sanitize dangerous property names such as __proto__, constructor, or prototype, allowing an unauthenticated attacker to inject crafted HTTP POST requests that modify Object.prototype. This can lead to privilege escalation, authentication bypass, or denial of service by compromising application logic or affecting other objects.", "risk_and_exploitability": "The vulnerability has a CVSS score of 9.3, indicating a high severity level. The EPSS score is below 1%, implying a low current exploitation probability. It is not listed in the CISA KEV catalog, so no known widespread exploitation has been reported. Attackers can exploit the issue remotely by sending arbitrary HTTP POST requests to endpoints that invoke formToObj(), without authentication. Successful exploitation could compromise application integrity or availability, and in multi\u2011tenant environments could allow attackers to elevate privileges or break authentication flows."}}}}, "created": "2026-02-04T12:06:07.804833+00:00", "updated": "2026-04-18T14:15:04.131480+00:00", "vendors": ["qwikdev", "qwikdev$PRODUCT$qwik"]}