Skip to content
OpenAdvisories

Package · npm

@builder.io/qwik

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.7
    CVE-2026-84994

    Qwik: Crashing any Qwik Server via Resource thenable

    Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first r…

    QwikDev BuilderIO qwik qwik npm
  • Critical 9.2
    CVE-2026-27971 Public exploit Scanner template

    Qwik affected by unauthenticated RCE via server$ Deserialization

    Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP …

    QwikDev qwik @builder.io/qwik npm
  • Medium 6.3
    CVE-2024-41677

    Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik

    Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in th…

    QwikDev qwik @builder.io/qwik npm
  • Critical 10.0
    CVE-2023-1283

    Code Injection in builderio/qwik

    Code Injection in GitHub repository builderio/qwik prior to 0.21.0.

    BuilderIO builderio/qwik @builder.io/qwik npm
  • Medium 6.1
    CVE-2023-0410

    Cross-site Scripting (XSS) - Generic in builderio/qwik

    Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.

    BuilderIO builderio/qwik @builder.io/qwik npm