What is GHSA-9wf9-qvvp-2929?

GHSA-9wf9-qvvp-2929 is a security advisory published by GitHub Security Advisories with Critical severity. builderio/qwik is vulnerable to code injection

Which CVE IDs does GHSA-9wf9-qvvp-2929 cover?

GHSA-9wf9-qvvp-2929 covers the following CVE IDs: CVE-2023-1283. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9wf9-qvvp-2929?

GHSA-9wf9-qvvp-2929 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9wf9-qvvp-2929?

GHSA-9wf9-qvvp-2929 affects 1 product, including: npm/@builder.io/qwik:\u003c 0.21.0.

GHSA-9wf9-qvvp-2929CriticalCVSS 9.8

builderio/qwik is vulnerable to code injection

Vendor

GitHub Security Advisories

Published

March 9, 2023

Last Modified

October 10, 2023

🔗 CVE IDs covered (1)

CVE-2023-1283 →

📋 Description

Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.

🎯 Affected products1

npm/@builder.io/qwik:< 0.21.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-1283
https://github.com/builderio/qwik/commit/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66
https://huntr.dev/bounties/63f1ff91-48f3-4886-a179-103f1ddd8ff8
https://github.com/BuilderIO/qwik/pull/3249/commits/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66
https://github.com/advisories/GHSA-9wf9-qvvp-2929