Advisories for Npm/@Builder.io/Qwik package

qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime.

A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0.

Code Injection in GitHub repository builderio/qwik prior to 0.21.0.

Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.