5vulnerabilities
- Critical2 (40.0%)
- High1 (20.0%)
- Medium0 (0.0%)
- Moderate2 (40.0%)
- Low0 (0.0%)
builder-io-qwik
Ecosystem: npm
Downloads: 203.75 K
- 2CriticalAffects 2 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting builder-io-qwik, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-x586-xvc8-g7q6 | High | Qwik: Crashing any Qwik Server via Resource thenable### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. ### Impact One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests. |
| GitHub (opens in a new tab) | |
| GHSA-p9x5-jp3h-96mm | Critical | Qwik vulnerable to Unauthenticated RCE via server$ Deserialization### Summary qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the `server$` RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where `require()` is available at runtime. ### Impact - Remote Code Execution |
| GitHub (opens in a new tab) | |
| GHSA-2rwj-7xq8-4gx4 | Moderate | Qwik has a potential mXSS vulnerability due to improper HTML escaping### Summary A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0. ### Details Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208 - If the string is an attribute value: - `"` -> `"` - `&` -> `&` - Other characters -> No conversion - Otherwise: - `<` -> `<` - `>` -> `>` - `&` -> `&` - Other characters -> No conversion It sometimes causes the situation that the final |
| GitHub (opens in a new tab) | |
| GHSA-9wf9-qvvp-2929 | Critical | builderio/qwik is vulnerable to code injectionCode Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js. |
| GitHub (opens in a new tab) | |
| GHSA-hm7f-rq7q-j9xp | Moderate | @builder.io/qwik vulnerable to Cross-site Scripting@builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled. |
| GitHub (opens in a new tab) |
- GHSA-x586-xvc8-g7q6HighQwik: Crashing any Qwik Server via Resource thenable
< 1.20.0
### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. ### Impact One unauthenticated request crashes the server. Looping keeps every replica dead as long as the attacker sends requests.
CVE: CVE-2026-84994
- GHSA-p9x5-jp3h-96mmCriticalQwik vulnerable to Unauthenticated RCE via server$ Deserialization
< 1.19.1
### Summary qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the `server$` RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where `require()` is available at runtime. ### Impact - Remote Code Execution
CVE: CVE-2026-27971
- GHSA-2rwj-7xq8-4gx4ModerateQwik has a potential mXSS vulnerability due to improper HTML escaping
< 1.7.3
### Summary A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0. ### Details Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208 - If the string is an attribute value: - `"` -> `"` - `&` -> `&` - Other characters -> No conversion - Otherwise: - `<` -> `<` - `>` -> `>` - `&` -> `&` - Other characters -> No conversion It sometimes causes the situation that the final
CVE: CVE-2024-41677
- GHSA-9wf9-qvvp-2929Criticalbuilderio/qwik is vulnerable to code injection
< 0.21.0
Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.
CVE: CVE-2023-1283
- GHSA-hm7f-rq7q-j9xpModerate@builder.io/qwik vulnerable to Cross-site Scripting
< 0.16.2
@builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled.
CVE: CVE-2023-0410