personal-security-checklist

Personal Security Checklist The ultimate list of tips to secure your digital life 🌐digital-defense.io 👉 Read the Checklist 👈 Contents The Checklist The Website The API Contributing Credits License The Checklist You can read the full checklist in CHECKLIST.md. To view/edit the raw data, see...

Qwik - Unauthenticated RCE via server$ Deserialization

Qwik =1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require availability at runtime. id: CVE-2026-27971 info: name: Qwik - Unauthenticated RCE via server$ Deserialization...

CVE-2026-27971_POC

CVE-2026-27971 — Qwik server$ Unauthenticated RCE PoC !WARNING This repository contains an active remote-code-execution proof of concept. Use it only against systems you own or are explicitly authorized to test. The author assumes no responsibility for unauthorized use or damage. A standalone...

Qwik: Crashing any Qwik Server via Resource thenable

Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolveresource.resolved. If resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL...

GHSA-X586-XVC8-G7Q6 Qwik: Crashing any Qwik Server via Resource thenable

Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolveresource.resolved. If resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-84994 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-84994 Source advisory: GHSA-X586-XVC8-G7Q6...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2026-84994 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2026-84994 Source advisory: OSV:GHSA-X586-XVC8-G7Q6...

EUVD-2026-99978

Qwik: Crashing any Qwik Server via Resource thenable...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994

The Qwik JavaScript framework is vulnerable in versions prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37 . The root cause is a flaw in default server-side qwik-json deserialization where ResourceSerializer.$fill$ passes resource._resolved to Promise.resolve without rejecting atta...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

PT-2026-112710

Name of the Vulnerable Software and Affected Versions @builder.io/qwik versions prior to 1.20.0 @qwik.dev/core versions prior to 2.0.0-beta.37 Description Default server-side qwik-json deserialization allows an unauthenticated request to provide a plain object where the then property is a QRL for...

CVE-2026-84994: Uncaught Exception

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

Qwik Dev: Improper exception handling leads to vulnerabilities

Qwik Dev Qwik has a vulnerability related to improper exception handling. This vulnerability stems from the default serialization process of qwik-json on the server side, which does not first reject the thenable controlled by the attacker. As a result, ResourceSerializer.$fill passes...

@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by CVE-2026-82260 via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: CVE-2026-82260 Source advisory: MEND:CVE-2026-82260...

Malicious Package

Overview npm-builderio-qwik-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in npm-builderio-qwik-poc (npm)

Source: amazon-inspector 11a743cdce28dd141d636ff13baaee44df53fbaaed17efdc5a7380281b7097e1 The package's main entry index.js is a working browser exploit, not a library. When loaded in a DOM context, it creates a hidden iframe pointing at www.pendo.io?builder.frameEditing=true, then sprays...