Qwik
CVE-2023-1283
CRITICAL
GHSA-9wf9-qvvp-2929
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on @builder.io/qwik (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.21.0.
DescriptionCVE.org
Code Injection in GitHub repository builderio/qwik prior to 0.21.0.
AnalysisAI
Code injection in Qwik framework before 0.21.0. PoC and patch available.
Technical ContextAI
CWE-94.
RemediationAI
Update.
RCE in Qwik JavaScript framework <= 1.19.0 via unsafe deserialization in server$ Runtime. EPSS 13.4% with PoC available.
Qwik is a performance focused javascript framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
Qwik JavaScript framework prior to 1.19.0 has a prototype pollution vulnerability that can lead to server-side code exec
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
Qwik, a performance-focused JavaScript framework, contains an array prototype pollution vulnerability in its FormData pa
A Cross-site Scripting (XSS) vulnerability exists in the Qwik framework (Node.js) prior to version 0.1.0-beta5, allowing
Improper serialization of virtual attributes in Qwik versions prior to 1.19.0 enables stored cross-site scripting attack
Qwik versions up to 1.19.0 is affected by url redirection to untrusted site (open redirect) (CVSS 6.1).
Qwik is a performance focused javascript framework. [CVSS 5.9 MEDIUM]
Qwik versions prior to 1.12.0 contain a regular expression parsing error in the isContentType function that allows attac
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today