CVE-2024-41677
Description
Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
How to fix
- qwik qwik1.7.3 or later
- @builder.io/qwik1.7.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qwik qwik | v < 1.7.3 | 1.7.3 |
| @builder.io/qwiknpm | v < 1.7.3 | 1.7.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.