← Vulnerability feed

Vulnerability record · CVE-2024-41677 · published 6 August 2024

CVE-2024-41677: Qwik cross-site scripting vulnerability

Qwik · Qwik

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

6.1 CVSS 3.1 Medium EPSS 0.50% · top 59.8% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.50%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208 Product
https://github.com/QwikDev/qwik/commit/7e742eb3a1001542d795776c0317d47df8b9d64e Patch
https://github.com/QwikDev/qwik/security/advisories/GHSA-2rwj-7xq8-4gx4 ExploitVendor Advisory

Track CVE-2024-41677 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-25150Qwik prototype pollution vulnerabilityQwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function w…EPSS 0.66%9.8CVE-2023-1283Qwik code injection vulnerabilityCode Injection in GitHub repository builderio/qwik prior to 0.21.0.EPSS 1.1%9.2CVE-2026-27971Qwik deserialization of untrusted data vulnerabilityQwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ …EPSS 2.9%7.5CVE-2026-32701Qwik type confusion vulnerabilityQwik is a performance-focused JavaScript framework. Versions prior to 1.19.2 improperly inferred arrays from dotted form field names during FormData …EPSS 0.53%7.1CVE-2026-25155Qwik cross-site request forgery vulnerabilityQwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect p…EPSS 0.14%6.5CVE-2023-2307Qwik cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.EPSS 0.27%6.1CVE-2023-0410Qwik cross-site scripting vulnerabilityCross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.EPSS 0.46%5.9CVE-2026-25151Qwik cross-site request forgery vulnerabilityQwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP r…EPSS 0.17%

Source: NIST National Vulnerability Database (record CVE-2024-41677), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.