Code Injection

2023-03-1613:18:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

qwik

code injection

purefunctionserializer

serializers.ts

javascript

server

EPSS

0.003

Percentile

71.7%

JSON

@builder.io/qwik, is vulnerable to Code Injection. The vulnerability is caused by the PureFunctionSerializer function in serializers.ts due to a lack of sanitization when deserializing data types, which allows an attacker to inject and execute malicious JavaScript into the server.