A crafted application/qwik-json request can reference a server-side module and exported symbol. Vulnerable Qwik versions may resolve an unregistered QRL through runtime require() and invoke it without authentication. This PoC attempts to reach a compatible process-execution export already present in the target's node_modules.

Requirements

Operator:

• Python 3.
• Network access to the exact Qwik route that processes the server$/Qwik JSON request.
• A listener reachable from the target when testing reverse-shell functionality.

Target:

• A vulnerable Qwik deployment using @builder.io/qwik <= 1.19.0.
• A runtime where require() is available.
• A compatible gadget module and export accessible in node_modules.
• node available in the service process PATH.
• Sufficient service-account permissions for the requested command or file operation.

No third-party Python packages are required.

Quick start

List the built-in gadgets without sending a request:

Run an active marker probe and try every built-in gadget:

[!IMPORTANT] --probe is not passive version detection. It attempts remote code execution and confirms it by printing a marker from the target process.

Usage examples

Execute a command:

Read a UTF-8 text file:

Write and verify a UTF-8 text file:

Request a reverse shell after starting a persistent listener:

Force the Windows reverse-shell payload when automatic OS detection is unsuitable:

The script does not start a listener. The --callback pre-check opens and closes a separate TCP connection before sending the shell payload, so use a listener that can accept more than one connection.

CLI reference

Action modes are not mutually exclusive in the parser. Use one of --probe, --CMD, --read, --write, or --lhost per invocation.

Built-in gadgets

--gadget auto tests these gadgets in the listed order. A custom gadget can be supplied as follows:

Important limitations

• A negative probe is not proof that the target is patched. It may indicate an incorrect route, a missing or incompatible gadget, a network/TLS error, filtering, or a different deployment layout.
• The default gadget is cross-spawn.sync, not automatic discovery. Use --gadget auto when the target dependency layout is unknown.
• The tool has no options for cookies, authorization headers, proxies, or arbitrary custom headers.
• File operations are text-oriented. --read expects UTF-8, and --write is not intended for binary data.
• Relative paths are resolved from the Qwik process working directory. All operations run with the Qwik service account's permissions.
• Reverse-shell success messages indicate that the exploit HTTP request was accepted; they do not prove that a callback was received.
• --rev-all may start several processes or callbacks on the target. Use it only in an isolated lab.
• Process exit codes primarily reflect probe and transport handling, not the exit status of the remote command or the presence of a working shell.
• The tool does not identify the installed Qwik version and should not be used as a replacement for dependency inventory.

Remediation

Upgrade @builder.io/qwik to 1.19.1 or later, update the lockfile, rebuild the application, and redeploy all server artifacts. Removing a compatible gadget alone is not a complete fix for the underlying Qwik vulnerability.

References

• Qwik security advisory — GHSA-p9x5-jp3h-96mm
• GitHub Advisory Database — CVE-2026-27971
• Patched Qwik 1.19.1 release
• Upstream fix commit
• CVE record
• NVD entry

Legal notice

This project is provided for security research, defensive validation, and authorized testing. Do not use it against systems without explicit permission.