漏洞关键信息 漏洞名称 Prototype Pollution via FormData Processing in Qwik City (CVE-2026-25150) 严重性 CVSS v3 base score: 9.3/10 Severity: Critical 影响范围 Package: qwik (npm) Affected versions: < 1.19.0 Patched versions: 1.19.0 描述 Summary: A prototype pollution vulnerability exists in the function within middleware. The function processes form field names with dot notation (e.g., ) to create nested objects but fails to sanitize dangerous property names like , , and . This allows unauthenticated attackers to pollute by sending crafted HTTP POST requests, potentially leading to privilege escalation, authentication bypass, or denial of service. Impact: An unauthenticated attacker can supply crafted form field names that cause to write dangerous keys (e.g., , , ) into parsed objects. This results in prototype pollution of the server process and can cause privilege escalation, auth bypass, denial-of-service, or other global application integrity failures depending on how objects are used. 参考资料 CWE-1321: Improperly Controlled Modification of Object Prototype Attributes OWASP - Prototype Pollution Prototype Pollution Attack in NodeJS Snyk - Prototype Pollution CVSS v3 base metrics Attack vector: Network Attack complexity: Low Privileges required: None User interaction: None Scope: Changed Confidentiality: None Integrity: High Availability: Low