Skip to content
OpenAdvisories

Package · npm

@builder.io/qwik

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.2
    CVE-2026-27971 Public exploit Scanner template

    Qwik affected by unauthenticated RCE via server$ Deserialization

    Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP …

    QwikDev qwik @builder.io/qwik npm