CVE-2026-25149: falha de baixa gravidade em QwikDev qwik
Qwik City Open Redirect via fixTrailingSlash
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.7epss 0.3%
Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:U
Produtos afetados
QwikDev · qwikCVEs relacionadas — QwikDev qwik
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27971CRITICALQwik affected by unauthenticated RCE via server$ DeserializationEPSS 5.5%CVE-2026-25150CRITICALPrototype Pollution via FormData Processing in Qwik CityEPSS 0.7%CVE-2026-84994HIGHQwik: Crashing any Qwik Server via Resource thenableEPSS 0.5%CVE-2024-41677MEDIUMCross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikEPSS 0.5%CVE-2026-32701HIGHQwik has array method pollution in FormData processing, allowing type confusion and DoSEPSS 0.5%CVE-2025-53620CRITICALCrashing any Qwik ServerEPSS 0.4%