CVE-2023-1283

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

CVE-2023-1283

creationtimestamp| type| source ---|---|--- 2023-03-09 00:51:29+00:00| seen| https://t.me/cibsecurity/59699 2025-03-05 15:32:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6546...

@leifermendez/partytown-qwik (>=1.0.3, <=1.0.7), cypress-ct-jordan-qwik (>=0.0.0-alpha-10, <=0.0.0-alpha-9) +1 more potentially affected by CVE-2023-1283 via @builder.io/qwik (>=0.9.0, <=0.18.1)

@builder.io/qwik NPM version =0.9.0, =1.0.3, =0.0.0-alpha-10, =0.0.0-alpha-9 - storybook-framework-qwik 0.0.1 Source cves: CVE-2023-1283 Source advisory: OSV:GHSA-9WF9-QVVP-2929...

CVE-2023-1283

CVE-2023-1283 affects builderio/qwik versions prior to 0.21.0. The vulnerability arises from the deserializer exposed via the pureServerFunction feature, enabling an unauthenticated attacker to inject and run arbitrary JavaScript code (via a crafted request to /q-data.json). Impact is code execut...