CVE-2026-25150
Prototype Pollution in Qwik-City Middleware Enables Privilege Escalation
Publication date: 2026-02-03
Last updated on: 2026-02-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qwik | qwik | to 1.19.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Qwik JavaScript framework prior to version 1.19.0, specifically in the formToObj() function within the @builder.io/qwik-city middleware. The function converts form field names that use dot notation (like user.name) into nested objects but does not properly sanitize dangerous property names such as __proto__, constructor, and prototype.
Because of this lack of sanitization, an unauthenticated attacker can send specially crafted HTTP POST requests that manipulate these dangerous property names, leading to prototype pollution. Prototype pollution allows the attacker to modify the Object.prototype, which can affect all objects in the application.
How can this vulnerability impact me? :
The prototype pollution vulnerability can have serious impacts including privilege escalation, authentication bypass, and denial of service.
- Privilege escalation: Attackers may gain higher-level permissions than intended.
- Authentication bypass: Attackers might bypass authentication mechanisms.
- Denial of service: The application could be made unavailable or unstable.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the @builder.io/qwik-city middleware to version 1.19.0 or later, where the prototype pollution issue in the formToObj() function has been patched.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know