EUVD-2025-20869

Malicious code in bioql PyPI...

EUVD-2023-0488

Malicious code in bioql PyPI...

EUVD-2023-0974

Malicious code in bioql PyPI...

CVE-2025-53620

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

Denial Of Service (DoS)

@builder.io/qwik-city is vulnerable to Denial Of Service DoS. The vulnerability is due to the server not handling errors thrown when an invalid QRL function qfunc is sent, which allows an attacker to crash the Node.js server by triggering an unhandled exception...

CVE-2025-53620

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620 Crashing any Qwik Server

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620 Crashing any Qwik Server

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620 Crashing any Qwik Server

@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...

CVE-2025-53620

The CVE-2025-53620 issue affects @builder.io/qwik-city (Qwik meta-framework) where executing a Qwik Server Action QRL may load the file containing the symbol; if an invalid qfunc is sent, the server does not handle the thrown error, causing a Node.js process exit. This is documented as a vulnerab...

qwik-lottie (>=0.0.5 <=0.0.6), storybook-framework-qwik (>=0.0.1 <=0.0.4) potentially affected by CVE-2025-53620 via @builder.io/qwik-city (>=0.0.112 <=0.0.128)

@builder.io/qwik-city NPM version =0.0.112, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2025-53620 Source advisory: OSV:GHSA-QR9H-J6XG-2J72...

GHSA-QR9H-J6XG-2J72 Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Summary Possibility to craft a request that will crash the Qwik Server in the default configuration. Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then...

Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests

Summary Possibility to craft a request that will crash the Qwik Server in the default configuration. Details When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then...

PT-2025-28958 · Builder.Io · @Builder.Io/Qwik-City

Name of the Vulnerable Software and Affected Versions: @builder.io/qwik-city versions prior to 1.13.0 Description: The @builder.io/qwik-city meta-framework for Qwik is susceptible to an issue where improper handling of invalid qfunc during the execution of a Qwik Server Action QRL can lead to a...

Qwik 安全漏洞

Qwik is a micro web framework open-sourced by Qwik Dev. A security vulnerability exists in Qwik versions prior to 1.13.0, which stems from an unhandled invalid qfunc error that could cause the service to crash...

CVE-2023-1283

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

CVE-2023-2307

Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...

CVE-2023-0410

Cross-site Scripting XSS - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5...

GHSA-2RWJ-7XQ8-4GX4 Qwik has a potential mXSS vulnerability due to improper HTML escaping

Summary A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0. Details Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules: https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.tsL1182-L12...

@adaliszk/qwik (>=1.5.1 <=1.5.5), @aid-on/qwiks (>=0.1.2 <=0.1.4) +34 more potentially affected by CVE-2024-41677 via @builder.io/qwik (>=0.15.2 <=1.4.5)

@builder.io/qwik NPM version =0.15.2, =1.5.1, =0.1.2, =0.0.1-beta.1, =0.0.1, =0.0.1-rc.0, =0.0.1-rc.0, =0.0.1-rc.0, =0.0.1, =0.0.1, =0.0.2-rc.0, =1.0.3, =1.0.7 - @melons/qwik-new-1 =0.0.1 and more Source cves: CVE-2024-41677 Source advisory: OSV:GHSA-2RWJ-7XQ8-4GX4...