Vulnerability GHSA-9wf9-qvvp-2929
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
3 years ago
March 09, 2023 at 12:30 AM UTC
builderio/qwik is vulnerable to code injection
0.0.1-mono - 0.20.1
0.0.1-mono - 0.20.1
Summary
builderio/qwik is vulnerable to code injection
Details
Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Qwik: Crashing any Qwik Server via Resource thenable
0.0.1-mono - 1.19.2 GHSA-x586-xvc8-g7q6
0.0.1-mono - 1.19.2 GHSA-x586-xvc8-g7q6
Critical
7 months ago
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
0.0.1-mono - 1.19.0 GHSA-p9x5-jp3h-96mm
0.0.1-mono - 1.19.0 GHSA-p9x5-jp3h-96mm
Medium Risk
2 years ago
Qwik has a potential mXSS vulnerability due to improper HTML escaping
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
Medium Risk
3 years ago
@builder.io/qwik vulnerable to Cross-site Scripting
0.0.1-mono - 0.16.1 GHSA-hm7f-rq7q-j9xp
0.0.1-mono - 0.16.1 GHSA-hm7f-rq7q-j9xp
Impacted packages
Timeline
Published
3 years ago
March 09, 2023 at 12:30 AM UTC
Fixed (0.21.0)
3 years ago
March 07, 2023 at 09:45 AM UTC
Last Modified
2 years ago
November 08, 2023 at 04:11 AM UTC