{"id":"CVE-2023-1283","aliases":["EUVD-2023-0974","GHSA-9wf9-qvvp-2929"],"status":"published","title":"Code Injection in builderio/qwik","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01149,"percentile":0.67082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2023-03-08T00:00:00Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"npm","package":"@builder.io/qwik","fixed_in":["0.21.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@builder.io/qwik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@builder.io/qwik","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}]}],"products":[{"vendor":"builderio","product":"builderio/qwik"},{"vendor":"qwik","product":"qwik"}],"references":[{"url":"https://huntr.dev/bounties/63f1ff91-48f3-4886-a179-103f1ddd8ff8","tags":["x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/BuilderIO/qwik/pull/3249/commits/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66","tags":["x_transferred","Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1283","tags":["advisory"]},{"url":"https://github.com/builderio/qwik/commit/4d9ba6e098ae6e537aa55abb6b8369bb670ffe66","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9wf9-qvvp-2929"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1283.json","tags":["advisory"]},{"url":"https://github.com/BuilderIO/qwik","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-1283","title":" Code Injection in builderio/qwik","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0.\n\n","status":"published","published":"2023-03-08T00:00:00Z","modified":"2025-03-05T15:18:04.224Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:31.657022Z"}],"euvd":[{"id":"EUVD-2023-0974","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0.\n\n","status":"published","published":"2023-03-08T00:00:00Z","modified":"2025-03-05T15:18:04Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:13.774215Z"}],"ghsa":[{"id":"GHSA-9wf9-qvvp-2929","title":"builderio/qwik is vulnerable to code injection","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.","status":"published","published":"2023-03-09T00:30:18Z","modified":"2023-10-10T21:23:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2023-1283","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0.\n\n","status":"published","published":"2023-03-08T22:15:09.683Z","modified":"2026-06-17T05:27:33.17Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-1283","title":" Code Injection in builderio/qwik","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0.\n\n","status":"published","published":"2023-03-08T00:00:00Z","modified":"2026-10-28T02:30:36.301775757Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"GHSA-9wf9-qvvp-2929","title":"builderio/qwik is vulnerable to code injection","description":"Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.","status":"published","published":"2023-03-09T00:30:18Z","modified":"2023-11-08T04:11:15.744811Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}