CVE-2026-27971
Published: 03 March 2026
Description
Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP…
more
request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the unsafe deserialization vulnerability in Qwik <=1.19.0 by requiring timely patching to the fixed version 1.19.1.
Validates untrusted HTTP request inputs to the server$ RPC deserialization mechanism, preventing processing of malicious payloads that trigger RCE.
Monitors and controls network traffic to the Qwik server, blocking or alerting on HTTP requests exploiting the deserialization vulnerability.
Security SummaryAI
CVE-2026-27971 affects Qwik, a performance-focused JavaScript framework, specifically versions up to and including 1.19.0. The vulnerability stems from unsafe deserialization in the server$ RPC mechanism, enabling remote code execution (RCE). It impacts any deployment where the require() function is available at runtime, as documented under CWE-502 (Deserialization of Untrusted Data). The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Any unauthenticated attacker can exploit this vulnerability over the network with low complexity by sending a single HTTP request. Successful exploitation allows arbitrary code execution on the server, potentially leading to full compromise including high confidentiality, integrity, and availability impacts.
The Qwik security advisory confirms the vulnerability is fixed in version 1.19.1. Administrators should upgrade to 1.19.1 or later to mitigate the issue. Additional details are available in the GitHub Security Advisory at https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote code execution via a single HTTP request to a public-facing Qwik application, directly mapping to exploitation of public-facing applications.