GHSA-9wf9-qvvp-2929

builderio/qwik is vulnerable to code injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-1283

Packages

Ecosystem	Package	Affected	Fixed in
npm	@builder.io/qwik	< 0.21.0	0.21.0

Details

As written in the advisory (Markdown source, shown as plain text).

Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-1283 advisory
https://github.com/BuilderIO/qwik/pull/3249/commits/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66 web
https://github.com/builderio/qwik/commit/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66 web
https://github.com/BuilderIO/qwik package
https://huntr.dev/bounties/63f1ff91-48f3-4886-a179-103f1ddd8ff8 web