CVE-2026-27971
Remote Code Execution in Qwik ≤1.19.0 via Unsafe Deserialization
Publication date: 2026-03-03
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qwik | qwik | to 1.19.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Qwik JavaScript framework versions up to 1.19.0. It is an unsafe deserialization flaw in the server RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server by sending a single HTTP request.
The issue arises when the server uses require() at runtime, enabling remote code execution (RCE). This means an attacker can run malicious code on the server without needing any authentication.
The vulnerability is fixed in version 1.19.1 of Qwik.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an attacker to execute arbitrary code on the server without authentication.
- Compromise of server integrity and control.
- Potential data theft or data manipulation.
- Disruption of services or denial of service.
- Use of the compromised server as a pivot point for further attacks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in Qwik versions up to 1.19.0 allows unauthenticated remote code execution via unsafe deserialization in the server RPC mechanism.
To mitigate this vulnerability immediately, upgrade Qwik to version 1.19.1 or later where the issue is fixed.
Additionally, ensure that deployments do not expose require() at runtime if possible, as this increases the attack surface.