Vulnerability GHSA-p9x5-jp3h-96mm
Critical
CRITICAL RISK
CVSS Score: 9.5
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
7 months ago
March 02, 2026 at 09:41 PM UTC
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
0.0.1-mono - 1.19.0
0.0.1-mono - 1.19.0
Summary
Qwik vulnerable to Unauthenticated RCE via server$ Deserialization
Details
Summary
qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime.
Impact
- Remote Code Execution
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
Qwik: Crashing any Qwik Server via Resource thenable
0.0.1-mono - 1.19.2 GHSA-x586-xvc8-g7q6
0.0.1-mono - 1.19.2 GHSA-x586-xvc8-g7q6
Medium Risk
2 years ago
Qwik has a potential mXSS vulnerability due to improper HTML escaping
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
0.0.1-mono - 1.7.2 GHSA-2rwj-7xq8-4gx4
Critical
3 years ago
builderio/qwik is vulnerable to code injection
0.0.1-mono - 0.20.1 GHSA-9wf9-qvvp-2929
0.0.1-mono - 0.20.1 GHSA-9wf9-qvvp-2929
Medium Risk
3 years ago
@builder.io/qwik vulnerable to Cross-site Scripting
0.0.1-mono - 0.16.1 GHSA-hm7f-rq7q-j9xp
0.0.1-mono - 0.16.1 GHSA-hm7f-rq7q-j9xp
Impacted packages
Timeline
Published
7 months ago
March 02, 2026 at 09:41 PM UTC
Fixed (1.19.1)
7 months ago
March 02, 2026 at 05:39 PM UTC
Last Modified
7 months ago
March 04, 2026 at 03:26 PM UTC