Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

緊急 9.8CVE-2026-27971 · GHSA-p9x5-jp3h-96mm · 03/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-27971 は qwik (qwik), @builder.io/qwik に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：5.5%（全脆弱性の 92.8% より高い）。
対処：1.19.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
qwik qwik	`< 1.19.1`	`1.19.1`
@builder.io/qwik npm	`< 1.19.1`	`1.19.1`

概要

Summary

qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime.

Impact

Remote Code Execution

NVD の説明

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.