Builder.Io Qwik vulnerabilities

CVE-2026-27971 [CRITICAL] CWE-502 Qwik vulnerable to Unauthenticated RCE via server$ Deserialization Qwik vulnerable to Unauthenticated RCE via server$ Deserialization ### Summary qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the `server$` RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where `require()` is available at runtime. ### Impact - Remote Code Execution

CVE-2026-84994 [HIGH] CWE-248 CVE-2026-84994: Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/c Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first rejecting attacker-controlled thenables. An unauthenticated request can provide a plain object

CVE-2023-1283 [CRITICAL] CWE-94 builderio/qwik is vulnerable to code injection builderio/qwik is vulnerable to code injection Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.

CVE-2024-41677 [MEDIUM] CWE-79 Qwik has a potential mXSS vulnerability due to improper HTML escaping Qwik has a potential mXSS vulnerability due to improper HTML escaping ### Summary A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0. ### Details Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208 - If the strin

CVE-2023-0410 [MEDIUM] CWE-79 @builder.io/qwik vulnerable to Cross-site Scripting @builder.io/qwik vulnerable to Cross-site Scripting @builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled.