medium6.1
CVE-2023-0410
@builder.io/qwik vulnerable to Cross-site Scripting
Impact
@builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @builder.io/qwik | < 0.16.2 | 0.16.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qwik | Qwik | before 0.16.2 |