Read the docs

QwikDev

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

QwikDev records in CISA KEV

No QwikDev vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Qwik 11 records HIGH

Records

16 records

TI-2023-01211 CVE-2023-1283 · GHSA-9wf9-qvvp-2929

Code Injection in builderio/qwik

Priority HIGH 82

Code Injection in GitHub repository builderio/qwik prior to 0.21.0.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01149 Published 2023-03-08 Fixed in 0.21.0 CWE-94
TI-2026-56751 CVE-2026-82286 · GHSA-98j5-x6wm-v8hp

gpt-crawler Arbitrary File Write via outputFileName Parameter

Priority HIGH 77

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00524 Published 2026-08-28 No fix listed CWE-22
TI-2025-33547 CVE-2025-53620 · GHSA-qr9h-j6xg-2j72

Crashing any Qwik Server

Priority HIGH 73

@builder.io/qwik-city is the meta-framework for Qwik.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00356 Published 2025-07-09 Fixed in 1.13.0 CWE-248
TI-2023-02164 CVE-2023-2307 · GHSA-c54w-7j5f-xg98

Cross-Site Request Forgery (CSRF) in builderio/qwik

Priority MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00269 Published 2023-04-26 Fixed in 0.104.0 CWE-352
TI-2023-00388 CVE-2023-0410 · GHSA-hm7f-rq7q-j9xp

Cross-site Scripting (XSS) - Generic in builderio/qwik

Priority MEDIUM 60

Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00479 Published 2023-01-20 Fixed in 0.1.0-beta5, 0.16.2 CWE-79
TI-2026-62522 CVE-2026-92781 · GHSA-mgr8-fxxv-82mj

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

Priority MEDIUM 57

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00359 Published 2026-09-16 No fix listed CWE-1321
TI-2026-62520 CVE-2026-92779 · GHSA-4qmr-g3pc-xvhm

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

Priority LOW 32

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00491 Published 2026-09-16 No fix listed CWE-1321
TI-2026-20317 CVE-2026-25155 · GHSA-vm6g-8r4h-22x8

Cross-site request forgery in QwikDev qwik

Priority LOW 30

Qwik is a performance focused javascript framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00147 Published 2026-02-03 Fixed in 1.12.0 CWE-352
Open these records in search →