CVE-2026-27971

CriticalRCE

Published: 03 March 2026

Published

03 March 2026

Modified

05 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.2617 96.4th percentile

Risk Priority 35 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27971 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Qwik Qwik. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the unsafe deserialization vulnerability in Qwik <=1.19.0 by requiring timely patching to the fixed version 1.19.1.

SI-10 Information Input Validation good match

prevent

Validates untrusted HTTP request inputs to the server$ RPC deserialization mechanism, preventing processing of malicious payloads that trigger RCE.

SC-7 Boundary Protection partial match

preventdetect

Monitors and controls network traffic to the Qwik server, blocking or alerting on HTTP requests exploiting the deserialization vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability enables unauthenticated remote code execution via a single HTTP request to a public-facing Qwik application, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP…

request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

Deeper analysisAI

CVE-2026-27971 affects Qwik, a performance-focused JavaScript framework, specifically versions up to and including 1.19.0. The vulnerability stems from unsafe deserialization in the server$ RPC mechanism, enabling remote code execution (RCE). It impacts any deployment where the require() function is available at runtime, as documented under CWE-502 (Deserialization of Untrusted Data). The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

Any unauthenticated attacker can exploit this vulnerability over the network with low complexity by sending a single HTTP request. Successful exploitation allows arbitrary code execution on the server, potentially leading to full compromise including high confidentiality, integrity, and availability impacts.

The Qwik security advisory confirms the vulnerability is fixed in version 1.19.1. Administrators should upgrade to 1.19.1 or later to mitigate the issue. Additional details are available in the GitHub Security Advisory at https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm.