CVE-2026-27971

CriticalRCE

Published: 03 March 2026

Published

03 March 2026

Modified

05 March 2026

KEV Added

—

Patch

—

CVSS Score v4 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0463 90.5th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-27971 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Qwik Qwik. Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-27971 affects Qwik, a performance-focused JavaScript framework, specifically versions up to and including 1.19.0. The vulnerability stems from unsafe deserialization in the server$ RPC mechanism, enabling remote code execution (RCE). It impacts any deployment where the require() function is available at runtime, as documented under CWE-502 (Deserialization of Untrusted Data). The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

Any unauthenticated attacker can exploit this vulnerability over the network with low complexity by sending a single HTTP request. Successful exploitation allows arbitrary code execution on the server, potentially leading to full compromise including high confidentiality, integrity, and availability impacts.

The Qwik security advisory confirms the vulnerability is fixed in version 1.19.1. Administrators should upgrade to 1.19.1 or later to mitigate the issue. Additional details are available in the GitHub Security Advisory at https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9345

Vulnerability details

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP…

request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability enables unauthenticated remote code execution via a single HTTP request to a public-facing Qwik application, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0