CVE-2026-27971

CRITICAL EXPLOITED NUCLEI

Qwik <=1.19.0 - Deserialization RCE

Title source: llm

Exploitation Summary

CVE-2026-27971 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Ghalendar. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC exploits CVE-2026-27971, an unauthenticated remote code execution vulnerability in Qwik <= 1.19.0 via unsafe deserialization in the `server$` RPC mechanism. The exploit leverages existing Node.js gadgets in `node_modules` to execute arbitrary commands, read/write files, or establish reverse shells.

Description

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

Exploits (1)

github WORKING POC

by Ghalendar · pythonremote

https://github.com/Ghalendar/CVE-2026-27971_POC

View Code ZIP pw:eip

This PoC exploits CVE-2026-27971, an unauthenticated remote code execution vulnerability in Qwik <= 1.19.0 via unsafe deserialization in the `server$` RPC mechanism. The exploit leverages existing Node.js gadgets in `node_modules` to execute arbitrary commands, read/write files, or establish reverse shells.

Classification

Working Poc 99%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Qwik framework (npm package @builder.io/qwik) <= 1.19.0

No auth needed

Prerequisites: Vulnerable Qwik version (<= 1.19.0) · Node.js `require()` available at runtime · Compatible gadget module (e.g., `cross-spawn`, `execa`) in `node_modules` · Network access to the Qwik `server$` endpoint

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 21, 2026 Full analysis →

Nuclei Templates (1)

Qwik - Unauthenticated RCE via server$ Deserialization

CRITICALVERIFIEDby omarkurt

Shodan: http.html:"q:version"

FOFA: body="q:version"

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm

Scores

CVSS v3 9.8

EPSS 0.0542

EPSS Percentile 91.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

VulnCheck KEV 2026-04-01

CWE

CWE-502

Status published

Products (2)

builder.io/qwik 0 - 1.19.1npm

qwik/qwik < 1.19.1

Published Mar 03, 2026

Tracked Since Mar 04, 2026