CVE-2026-27971CWE-502

Qwik affected by unauthenticated RCE via server$ Deserialization

Critical · published March 3, 2026

CVSS v4.0
9.2
EPSS
3%
Percentile
87.1
In the wild
Unconfirmed
What it is

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02948 · 87.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-03-03T22:55Z
EPSS history
Timeline
  • 03 MAR 22:55Z
    Qwik affected by unauthenticated RCE via server$ Deserialization
    cvelistv5