PT-2023-16248 · Builder.Io · @Builder.Io/Qwik

Published 2023-01-20 · Updated 2026-03-13 · CVE-2023-0410

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions @builder.io/qwik versions prior to 0.16.2 @builder.io/qwik versions prior to 0.1.0-beta5

Description The issue is related to Cross-site Scripting (XSS) due to improper handling of attribute names and the class attribute values.

Recommendations For versions prior to 0.16.2, update to version 0.16.2 or later. For versions prior to 0.1.0-beta5, update to version 0.1.0-beta5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-0410

GHSA-HM7F-RQ7Q-J9XP

Affected Products

@Builder.Io/Qwik

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0410.json · Exploit
• https://github.com/builderio/qwik/commit/4b2f89dbbd2bc0a2c92eae1a49bdd186e589151a · Patch
• https://osv.dev/vulnerability/GHSA-hm7f-rq7q-j9xp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0410 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0410 · Vendor Advisory
• https://github.com/BuilderIO/qwik · Note
• https://huntr.dev/bounties/2da583f0-7f66-4ba7-9bed-8e7229aa578e · Note
• https://t.me/cibsecurity/56744 · Telegram Post
• https://t.me/cvenotify/42876 · Telegram Post
• https://t.me/cveNotify/155464 · Telegram Post