CVE-2026-27971

Опубликовано: 03 мар. 2026

Источник: nvd

CVSS3: 9.8

EPSS Средний

Описание

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

Ссылки

https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:qwik:qwik:*:*:*:*:*:node.js:*:*

Версия до 1.19.1 (исключая)

EPSS

Процентиль: 96%

0.23118

Средний

9.8 Critical

CVSS3

Дефекты

CWE-502

Связанные уязвимости

CVE-2026-27971

CVSS3: 9.8

debian

27 дней назад

Qwik is a performance focused javascript framework. qwik <=1.19.0 is v ...

GHSA-p9x5-jp3h-96mm

github

28 дней назад

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization