GitHub Advisoryadvisory · npm

GHSA-p9x5-jp3h-96mm Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

CRITICAL Published 2026-03-02 Modified 2026-03-04 Official page ↗
Aliases
CVE-2026-27971
Ecosystem
npm
Packages
@builder.io/qwik
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-502
Reviewed
2026-03-02

Affected packages

• npm @builder.io/qwik: < 1.19.1 → fixed in 1.19.1

Description

Summary qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the `server$` RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where `require()` is available at runtime. Impact • Remote Code Execution

Related

Alias · CVE (1)

  • CVE-2026-27971 Qwik is a performance focused javascript framework. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References