CVE-2023-1283: Code Injection in @builder.io/qwik
Summary
CVE-2023-1283: builderio/qwik is vulnerable to code injection. Affects @builder.io/qwik versions < 0.21.0. Fixed in 0.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @builder.io/qwik package is an npm package that provides a framework for building web applications with server-side rendering. It allows developers to create interactive UI components and server-side functions. The package is widely used in web development projects and has a large user base. However, prior to version 0.21.0, the package is vulnerable to code injection.
Vulnerability Detail
The vulnerability in @builder.io/qwik allows for code injection through the Function deserializer. This vulnerability can be exploited by accessing the pureServerFunction feature, which enables the execution of arbitrary JavaScript code in a node.js environment. An attacker can take advantage of this to run malicious code on the server, potentially leading to unauthorized access, data breaches, or other security issues.
How To Fix
Latest published version: 1.20.2 as of 23 Oct 2026
npm install @builder.io/qwik@1.20.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.21.0
This is the first release that contains the fix.
npm install @builder.io/qwik@0.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the package to mitigate the risk of code injection.
Conclusion
The code injection vulnerability in @builder.io/qwik prior to version 0.21.0 can have severe consequences, including unauthorized access and data breaches. It is crucial to update the package to the fixed version to mitigate the risk. For further support and guidance on vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for @builder.io/qwik →
FAQ
@builder.io/qwik is an npm package used for building web applications with server-side rendering. It provides a framework for creating interactive UI components and server-side functions.
Code injection is a security vulnerability that allows an attacker to insert and execute malicious code in an application. In the case of @builder.io/qwik, the code injection vulnerability enables the execution of arbitrary JavaScript code on the server.
The code injection vulnerability in @builder.io/qwik can lead to unauthorized access, data breaches, and other security issues. An attacker can run malicious code on the server, potentially compromising sensitive data or gaining control over the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for @builder.io/qwik.
