CVE-2024-41677

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-79

• https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208Product
• https://github.com/QwikDev/qwik/commit/7e742eb3a1001542d795776c0317d47df8b9d64ePatch
• https://github.com/QwikDev/qwik/security/advisories/GHSA-2rwj-7xq8-4gx4Exploit, Vendor Advisory

Published

Aug 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41671Twisted is an event-based framework for internet application…8.3
• CVE-2024-41672DuckDB is a SQL database management system. In versions 1.0.…7.5
• CVE-2024-41673Decidim is a participatory democracy framework. The version …7.1
• CVE-2024-41674CKAN is an open-source data management system for powering d…5.3
• CVE-2024-41675CKAN is an open-source data management system for powering d…6.1
• CVE-2024-41676Magento-lts is a long-term support alternative to Magento Co…4.8
• CVE-2024-41678GLPI is a free asset and IT management software package. An …6.1
• CVE-2024-41679GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-4168A vulnerability was found in Tenda 4G300 1.01.42. It has bee…8.8
• CVE-2024-41681A vulnerability has been identified in Location Intelligence…7.5
• CVE-2024-41682A vulnerability has been identified in Location Intelligence…5.3
• CVE-2024-41683A vulnerability has been identified in Location Intelligence…5.3