The vulnerability arises from unsafe deserialization in Qwik’s server$ RPC mechanism. A single HTTP request can cause an attacker to execute arbitrary code on the server, granting full remote code execution. This flaw corresponds to CWE‑502 (Deserialization of Untrusted Data).

QwikDev’s Qwik framework versions 1.19.0 and earlier are affected. The issue occurs in deployments that run Qwik within a Node.js environment where the require() function is available at runtime. The fix is available in Qwik 1.19.1 and later releases.

The CVSS score of 9.2 indicates critical severity. With an EPSS of 30%, the likelihood of exploitation is high. Although not yet listed in the CISA KEV catalog, the flaw’s unfiltered access path—any HTTP request to a server$ RPC endpoint—provides a straightforward attack vector. Successful exploitation would allow an attacker to run arbitrary code with the permissions of the Qwik process, potentially compromising the underlying operating system and data.