builderio/qwik is vulnerable to code injection

CRÍTICO 9.8CVE-2023-1283 · GHSA-9wf9-qvvp-2929 · Published 08/03/2023 · updated 17/06/2026

En resumen

CVE-2023-1283 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a qwik (qwik), @builder.io/qwik.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 66.9% de las vulnerabilidades.
Solución: actualizar a 0.21.0 o posterior.

Package	Affected versions	Patched versions
qwik qwik	`< 0.21.0`	`0.21.0`
@builder.io/qwik npm	`< 0.21.0`	`0.21.0`

Description

Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.

NVD description

Code Injection in GitHub repository builderio/qwik prior to 0.21.0.

References

nvd.nist.gov/vuln/detail/CVE-2023-1283 · ADVISORY
BuilderIO/qwik#3249 · WEB
builderio/qwik commit 4d9ba6e · WEB
BuilderIO/qwik · PACKAGE
huntr.dev/bounties/63f1ff91-48f3-4886-a179-103f1ddd8ff8 · WEB

Más vulnerabilidades de qwik

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

qwik

< 0.21.0

0.21.0

@builder.io/qwik

npm

< 0.21.0

0.21.0

Más vulnerabilidades de qwik

Ver todo →