The vulnerability is a prototype‑pollution flaw in the Qwik framework's formToObj() function, which processes form field names with dot notation. It does not sanitize dangerous property names such as __proto__, constructor, or prototype, allowing an unauthenticated attacker to inject crafted HTTP POST requests that modify Object.prototype. This can lead to privilege escalation, authentication bypass, or denial of service by compromising application logic or affecting other objects.

The flaw affects QwikDev's Qwik framework, specifically the @builder.io/qwik-city middleware. Any instance running a version prior to 1.19.0 is vulnerable. Users employing older Qwik releases in production should verify if their code imports and uses this middleware.

The vulnerability has a CVSS score of 9.3, indicating a high severity level. The EPSS score is below 1%, implying a low current exploitation probability. It is not listed in the CISA KEV catalog, so no known widespread exploitation has been reported. Attackers can exploit the issue remotely by sending arbitrary HTTP POST requests to endpoints that invoke formToObj(), without authentication. Successful exploitation could compromise application integrity or availability, and in multi‑tenant environments could allow attackers to elevate privileges or break authentication flows.