CVE-2026-25148: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25148 is a Cross-Site Scripting (XSS) vulnerability in Qwik.js' server-side rendering (SSR) virtual attribute serialization, formally titled "Qwik SSR XSS via Unsafe Virtual Node Serialization." It affects the @builder.io/qwik-city npm package in all versions prior to 1.19.0. The vulnerability was published on February 3, 2026, by researcher "wodzen" via the GitHub Security Advisory GHSA-m6jq-g7gq-5w3c. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Qwik Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). Qwik v1 does not use traditional hydration; instead, it serializes application state into HTML comments to mark Virtual component boundaries, enabling client-side resumability. The renderVirtualAttributes function in packages/qwik/src/core/render/ssr/render-ssr.ts concatenated attribute names and values directly into HTML comment content without any escaping or quoting. An attacker who can influence Virtual Node attribute keys or values (e.g., via user-controlled slot names or dynamic props) can inject a --> sequence to prematurely close the HTML comment and append arbitrary HTML or JavaScript. The fix, applied in commit fe2d923, introduces an escapeValue() helper that calls escapeHtml() on string attribute values before serialization, and also escapes slot names via escapeHtml() in splitProjectedChildren and renderSSRComponent (Qwik Security Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in a victim's browser within the context of the affected origin, enabling session hijacking, credential theft, phishing, or unauthorized actions on behalf of the user. Only applications that dynamically populate Virtual Node attributes with user-controlled keys or values are affected; applications with hard-coded attributes are not vulnerable. Additionally, because Qwik relies on these HTML comment markers for its resumability mechanism, injecting malformed comment content can cause resume/hydration desynchronization, leading to unpredictable client-side behavior beyond script injection (GitHub Advisory, Qwik Security Advisory).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.026% (8th percentile), indicating a low near-term probability of exploitation. Exploitation requires user interaction (a victim must visit a page rendering attacker-controlled Virtual Node attributes) but requires no privileges from the attacker (GitHub Advisory).

1. Identify a vulnerable target: Find a Qwik v1 application (npm package @builder.io/qwik-city < 1.19.0) that dynamically populates Virtual Node attributes — such as slot names or component props — with user-supplied input.
2. Craft a malicious payload: Construct an input value containing --> to prematurely close the HTML comment, followed by arbitrary HTML/JS. For example, a slot name or attribute value such as --> would break out of the comment context.
3. Deliver the payload: Submit the malicious value through whatever application input mechanism populates the Virtual Node attribute (e.g., a URL parameter, form field, or API request that influences slot names or dynamic props passed to Qwik SSR components).
4. Trigger server-side rendering: Cause the server to render a page that includes the attacker-controlled Virtual Node attribute. The SSR engine concatenates the unescaped value into an HTML comment, e.g., <!--qv key=-->, breaking the comment and injecting the payload into the HTML response.
5. Achieve script execution: When a victim's browser loads the server-rendered page, the injected script executes in the origin's context, enabling session token theft, DOM manipulation, credential harvesting, or further attacks (Qwik Security Advisory, Patch Commit).

• Network: HTTP requests to Qwik SSR endpoints containing --> or HTML/script tag sequences in parameters that map to Virtual Node attributes or slot names; unusual outbound connections from victim browsers to attacker-controlled domains following page load.
• Logs: Server-side access logs showing requests with URL-encoded or raw -->, <script>, or event handler strings in query parameters or POST bodies that feed into SSR rendering.
• File System / Response Content: Server-rendered HTML responses containing broken HTML comment structures (e.g., <!--qv ...--> comments that are prematurely closed) or unexpected <script> tags embedded within or adjacent to Qwik component boundary comments (<!--qv / <!--/qv-->).
• Browser Behavior: Unexpected JavaScript execution on pages served by Qwik SSR applications; browser console errors related to Qwik resumability or hydration failures coinciding with anomalous script activity.

The vulnerability is patched in @builder.io/qwik-city version 1.19.0. Users should upgrade immediately by running npm install @builder.io/qwik-city@1.19.0 or later. As a temporary workaround for teams unable to patch immediately, ensure that no user-controlled data is passed as Virtual Node attribute keys or values in SSR-rendered components — applications that hard-code all such attributes are not affected by this vulnerability. Review all Qwik SSR components that accept dynamic props or slot names derived from user input and sanitize or restrict those inputs at the application layer until the upgrade is applied (Qwik Security Advisory, Patch Commit).

The vulnerability was reported by researcher "wodzen" and published by "Varixo" via the QwikDev GitHub Security Advisory on February 3, 2026. No notable public commentary from prominent security researchers or significant media coverage has been identified beyond standard vulnerability database aggregation (Qwik Security Advisory).