CVE-2026-25149

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that appear to originate from the trusted domain but redirect the victim to an attacker-controlled site. This issue has been patched in version 1.19.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-25155.3The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due t CVE-2026-2515010.0Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() f CVE-2026-251515.9Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interpre CVE-2026-251526.5Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251538.8Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251546.1LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without need CVE-2026-251557.1Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes in CVE-2026-251566.3HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Co CVE-2026-251577.5OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in CVE-2026-25167.0A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDE CVE-2026-251607.4Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables CVE-2026-251618.8Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains