Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

16 records

Vendor: QwikDev Clear all filters
TI-2026-62522 CVE-2026-92781 · GHSA-mgr8-fxxv-82mj

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

Priority MEDIUM 57

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00359 Published 2026-09-16 No fix listed CWE-1321
TI-2026-62520 CVE-2026-92779 · GHSA-4qmr-g3pc-xvhm

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

Priority LOW 32

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00491 Published 2026-09-16 No fix listed CWE-1321
TI-2026-56751 CVE-2026-82286 · GHSA-98j5-x6wm-v8hp

gpt-crawler Arbitrary File Write via outputFileName Parameter

Priority HIGH 77

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00524 Published 2026-08-28 No fix listed CWE-22
TI-2026-20317 CVE-2026-25155 · GHSA-vm6g-8r4h-22x8

Cross-site request forgery in QwikDev qwik

Priority LOW 30

Qwik is a performance focused javascript framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00147 Published 2026-02-03 Fixed in 1.12.0 CWE-352
TI-2025-33547 CVE-2025-53620 · GHSA-qr9h-j6xg-2j72

Crashing any Qwik Server

Priority HIGH 73

@builder.io/qwik-city is the meta-framework for Qwik.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00356 Published 2025-07-09 Fixed in 1.13.0 CWE-248
TI-2023-02164 CVE-2023-2307 · GHSA-c54w-7j5f-xg98

Cross-Site Request Forgery (CSRF) in builderio/qwik

Priority MEDIUM 62

Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00269 Published 2023-04-26 Fixed in 0.104.0 CWE-352
TI-2023-01211 CVE-2023-1283 · GHSA-9wf9-qvvp-2929

Code Injection in builderio/qwik

Priority HIGH 82

Code Injection in GitHub repository builderio/qwik prior to 0.21.0.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01149 Published 2023-03-08 Fixed in 0.21.0 CWE-94
TI-2023-00388 CVE-2023-0410 · GHSA-hm7f-rq7q-j9xp

Cross-site Scripting (XSS) - Generic in builderio/qwik

Priority MEDIUM 60

Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00479 Published 2023-01-20 Fixed in 0.1.0-beta5, 0.16.2 CWE-79