Qwik
CVE-2023-0410
MEDIUM
GHSA-hm7f-rq7q-j9xp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.
AnalysisAI
A Cross-site Scripting (XSS) vulnerability exists in the Qwik framework (Node.js) prior to version 0.1.0-beta5, allowing unauthenticated attackers to inject malicious scripts through user interaction. The vulnerability has a CVSS score of 6.1 (Medium) with low exploitation probability (EPSS 0.34%, 56th percentile), indicating limited real-world risk despite the XSS classification. A patch is available from the vendor, and no active exploitation or public POC has been widely documented.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), affecting the Qwik framework (cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*) in its Node.js runtime environment. Qwik is a modern JavaScript framework focused on performance and resumability. The XSS flaw suggests improper input validation or output encoding in template rendering or component handling, allowing attackers to execute arbitrary JavaScript in the context of affected web applications built with vulnerable Qwik versions. The issue was likely in framework-level template processing or DOM manipulation code.
RemediationAI
Upgrade Qwik framework to version 0.1.0-beta5 or later; details: The vulnerability was patched in commit 4b2f89dbbd2bc0a2c92eae1a49bdd186e589151a on the builderio/qwik repository Mitigation: For applications unable to immediately patch, implement strict Content Security Policy (CSP) headers to limit the impact of XSS; details: CSP can prevent inline script execution and restrict script sources, reducing XSS impact severity
RCE in Qwik JavaScript framework <= 1.19.0 via unsafe deserialization in server$ Runtime. EPSS 13.4% with PoC available.
Code injection in Qwik framework before 0.21.0. PoC and patch available.
Qwik is a performance focused javascript framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
Qwik JavaScript framework prior to 1.19.0 has a prototype pollution vulnerability that can lead to server-side code exec
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
Qwik, a performance-focused JavaScript framework, contains an array prototype pollution vulnerability in its FormData pa
Improper serialization of virtual attributes in Qwik versions prior to 1.19.0 enables stored cross-site scripting attack
Qwik versions up to 1.19.0 is affected by url redirection to untrusted site (open redirect) (CVSS 6.1).
Qwik is a performance focused javascript framework. [CVSS 5.9 MEDIUM]
Qwik versions prior to 1.12.0 contain a regular expression parsing error in the isContentType function that allows attac
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today