Executive brief
Qwik is a JavaScript framework used for building web applications. An unsafe deserialization flaw in its server$ RPC (remote procedure call) mechanism allows attackers to execute arbitrary code on servers running Qwik without authentication. This enables full compromise of the affected server and any data it contains.
Technical details
The vulnerability is a CWE-502 unsafe deserialization issue in the server$ RPC mechanism of Qwik versions ≤1.19.0. It allows unauthenticated attackers to execute arbitrary code on the server via a single HTTP request, provided that require() is available at runtime. The attack requires no privileges, no authentication, and minimal attack complexity. Successful exploitation grants remote code execution with full system access (confidentiality, integrity, and availability impact). The vulnerability was patched in version 1.19.1.
Affected products
- Builder.io Qwik <=1.19.0
Timeline
- 2026-03-02: disclosed
- 2026-03-02: patched: Version 1.19.1 released