{"action":"Upgrade @builder.io/qwik-city to 1.19.0 or later.","affected":[{"fixed":"1.19.0","introduced":"0"}],"component":"@builder.io/qwik-city","cve_ids":["CVE-2026-25148"],"ecosystem":"npm","epss":0.00349,"exploited":false,"fixed_versions":["1.19.0"],"ghsa_id":"GHSA-m6jq-g7gq-5w3c","id":"tcs_01M5KFZVM3HR0PFJV3V0214H9R","modified_at":"2026-02-04T18:06:22.472203Z","published_at":"2026-02-03T20:47:55Z","references":["https://osv.dev/vulnerability/GHSA-m6jq-g7gq-5w3c","https://github.com/QwikDev/qwik/security/advisories/GHSA-m6jq-g7gq-5w3c","https://nvd.nist.gov/vuln/detail/CVE-2026-25148","https://github.com/QwikDev/qwik/commit/fe2d9232c0bcec99411d51a00dae29295871d094","https://github.com/QwikDev/qwik"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-m6jq-g7gq-5w3c","url":"https://osv.dev/vulnerability/GHSA-m6jq-g7gq-5w3c"},{"source":"nvd","source_id":"CVE-2026-25148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25148"}],"summary":"Qwik SSR XSS via Unsafe Virtual Node Serialization"}