PT-2026-22844 · Qwik · Qwik

Sebastianosrt · Published 2026-03-02 · Updated 2026-03-25 · CVE-2026-27971

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qwik versions up to and including 1.19.0

Description Qwik is susceptible to Remote Code Execution (RCE) due to an unsafe deserialization issue within the server$ RPC mechanism. This allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. The issue affects deployments where the require() function is available at runtime. Approximately 46,000 services utilizing Qwik have been identified. The server$ RPC mechanism is the component directly involved in this issue.

Recommendations Update to Qwik version 1.19.1 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-27971

GHSA-P9X5-JP3H-96MM

Affected Products

Qwik

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27971.json · Exploit
• https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27971 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9x5-jp3h-96mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27971 · Security Note
• https://github.com/QwikDev/qwik · Note
• https://github.com/QwikDev/qwik/releases/tag/%40builder.io%2Fqwik%401.19.1 · Note
• https://t.me/proxy_bar/3196 · Telegram Post
• https://twitter.com/vuln_tracker/status/2029016958616895716 · Twitter Post
• https://twitter.com/vuln_tracker/status/2031179310544073202 · Twitter Post
• https://twitter.com/autumn_good_35/status/2029521752653717958 · Twitter Post
• https://twitter.com/CVEnew/status/2028974429405896718 · Twitter Post
• https://twitter.com/HunterMapping/status/2029107273507758191 · Twitter Post
• https://twitter.com/Divert_Security/status/2036850603717013856 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2029014161506681130 · Twitter Post