fkie_cve-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

GHSA-r5mf-4r5x-q78f — Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable

Affected: npm: @quasar/render-ssr-error, npm: @quasar/app-vite

### Summary

The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `<script>` element behind a `replaceAll('</script>', ...)` guard that is ASCII-case-sensitive and requires a literal `>`, so `</SCRIPT>`, `</script >` and `</script/>` all escape the element and give script execution in the dev server's origin.

### Details

`renderSSRError()` builds the page by splicing a JSON blob into a prebuilt bundle (`utils/render-ssr-error/src/index.js`):

```js errorHtml: before + JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) + after ```

`before` and `after` are the two halves of the compiled error-page UI, split inside a `<script type="module">` element, so `data` is emitted as a JS object literal in raw script text. The data itself comes from `utils/render-ssr-error/src/env.js`:

```js function getEnvironmentVariablesData () { return Object.keys(process.env).reduce((acc, name) => { acc[ name ] = process.env[ name ] return acc }, {}) }

export function getEnv (req) { return { Request: getRequestData(req), Headers: getHeadersData(req), Cookies: getCookiesData(req),…

Most recent entries from all

fkie_cve-2026-106106

GHSA-r5mf-4r5x-q78f — Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable