Vulnerability GHSA-hm7f-rq7q-j9xp
Medium Risk
MEDIUM RISK
CVSS Score: 6.1
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 years ago
January 20, 2023 at 03:30 AM UTC
@builder.io/qwik vulnerable to Cross-site Scripting
0.0.1-mono - 0.16.1
0.0.1-mono - 0.16.1
Summary
@builder.io/qwik vulnerable to Cross-site Scripting
Details
@builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Qwik: Crashing any Qwik Server via Resource thenable
0.0.1-mono - 1.19.2 GHSA-x586-xvc8-g7q6
0.0.1-mono - 1.19.2 GHSA-x586-xvc8-g7q6
Critical
7 months ago
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
0.0.1-mono - 1.19.0 GHSA-p9x5-jp3h-96mm
0.0.1-mono - 1.19.0 GHSA-p9x5-jp3h-96mm
Medium Risk
2 years ago
Qwik has a potential mXSS vulnerability due to improper HTML escaping
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
Critical
3 years ago
builderio/qwik is vulnerable to code injection
0.0.1-mono - 0.20.1 GHSA-9wf9-qvvp-2929
0.0.1-mono - 0.20.1 GHSA-9wf9-qvvp-2929
Impacted packages
Timeline
Published
3 years ago
January 20, 2023 at 03:30 AM UTC
Fixed (0.16.2)
3 years ago
January 04, 2023 at 07:30 PM UTC
Last Modified
2 years ago
November 08, 2023 at 04:11 AM UTC