PT-2026-6275 · Builder.Io+1 · @Builder.Io/Qwik-City+1

Yueyuel · Published 2026-02-03 · Updated 2026-02-04 · CVE-2026-25150

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qwik versions prior to 1.19.0

Description Qwik is a performance focused javascript framework. A prototype pollution issue exists in the formToObj() function within the @builder.io/qwik-city middleware. The function processes form field names using dot notation, but does not sanitize dangerous property names like proto, constructor, and prototype. This allows unauthenticated attackers to pollute Object.prototype by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service.

Recommendations Update to version 1.19.0 or later.

Exploit

Fix

LPE

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-25150

GHSA-XQG6-98CW-GXHQ

Affected Products

@Builder.Io/Qwik-City

Qwik

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25150.json · Exploit
• https://github.com/QwikDev/qwik/security/advisories/GHSA-xqg6-98cw-gxhq · Vendor Advisory
• https://github.com/QwikDev/qwik/commit/5f65bae2bc33e6ca0c21e4cfcf9eae05077716f7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-25150 · Security Note
• https://osv.dev/vulnerability/GHSA-xqg6-98cw-gxhq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25150 · Vendor Advisory
• https://github.com/QwikDev/qwik · Note
• https://twitter.com/0dayPublishing/status/2018798286107209958 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1qvcy3d/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcxbd/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/CCBalert/status/2019125446944727432 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1qvczeq/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1qvcyij/resumen_diario_de_vulnerabilidades_04022026 · Reddit Post
• https://twitter.com/CVEnew/status/2018913271890300975 · Twitter Post
• https://t.me/CVEtracker/43655 · Telegram Post