PT-2026-6275 · Builder.Io+1 · @Builder.Io/Qwik-City+1

Yueyuel · Publicado 2026-02-03 · Atualizado 2026-02-04 · CVE-2026-25150

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qwik versions prior to 1.19.0

Description Qwik is a performance focused javascript framework. A prototype pollution issue exists in the formToObj() function within the @builder.io/qwik-city middleware. The function processes form field names using dot notation, but does not sanitize dangerous property names like proto, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service.

Recommendations Update to version 1.19.0 or later.

Exploit

Correção

LPE

DoS

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CVE-2026-25150

GHSA-XQG6-98CW-GXHQ

Produtos afetados

@Builder.Io/Qwik-City

Qwik

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25150.json · Exploit
• https://github.com/QwikDev/qwik · Nota
• https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq · Aviso do Fabricante
• https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-25150 · Nota de Segurança
• https://twitter.com/0dayPublishing/status/2018798286107209958 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1qvcy3d/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://twitter.com/CCBalert/status/2019125446944727432 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Publicação no Reddit
• https://twitter.com/CVEnew/status/2018913271890300975 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-xqg6-98cw-gxhq · Aviso do Fabricante
• https://t.me/CVEtracker/43655 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-25150 · Aviso do Fabricante