Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
18 vulnerabilities by quasarframework
CVE-2026-106109 (GCVE-0-2026-106109)
Vulnerability from nvd – Published: 2026-10-06 17:32 – Updated: 2026-10-06 19:43
VLAI
EPSS
VEX
Title
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:43 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
>= 2.7.0, < 2.23.3
|
|
| @quasar | app-vite |
Affected:
>= 1.0.0, < 3.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:43:25.036654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:43:35.076Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.0, \u003c 2.23.3"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:32:08.136Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93"
},
{
"name": "https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-q9mq-245r-4g93",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106109",
"datePublished": "2026-10-06T17:32:08.136Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:43:35.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106107 (GCVE-0-2026-106107)
Vulnerability from nvd – Published: 2026-10-06 17:26 – Updated: 2026-10-06 19:29
VLAI
EPSS
VEX
Title
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:25 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.4
|
|
| @quasar | app-vite |
Affected:
< 3.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:25:52.348218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:29:55.266Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.4"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:26:19.769Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7"
},
{
"name": "https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-5m6h-8g35-p3m7",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106107",
"datePublished": "2026-10-06T17:26:19.769Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:29:55.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106106 (GCVE-0-2026-106106)
Vulnerability from nvd – Published: 2026-10-06 17:24 – Updated: 2026-10-06 18:22
VLAI
EPSS
VEX
Title
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:22 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.3
|
|
| @quasar | render-ssr-error |
Affected:
< 2.2.4
|
|
| @quasar | app-vite |
Affected:
< 3.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106106",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:22:31.217011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:22:44.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.3"
}
]
},
{
"product": "render-ssr-error",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.4"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer\u0027s request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:24:07.788Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
},
{
"name": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-r5mf-4r5x-q78f",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106106",
"datePublished": "2026-10-06T17:24:07.788Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T18:22:44.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106105 (GCVE-0-2026-106105)
Vulnerability from nvd – Published: 2026-10-06 17:20 – Updated: 2026-10-06 17:53
VLAI
EPSS
VEX
Title
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:53 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.3
|
|
| @quasar | app-vite |
Affected:
< 3.3.0
|
|
| @quasar | cli |
Affected:
< 5.0.4
|
|
| @quasar | ssl-certificate |
Affected:
< 2.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:53:50.770402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:53:57.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.3"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
},
{
"product": "cli",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.4"
}
]
},
{
"product": "ssl-certificate",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:20:36.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv"
},
{
"name": "https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4"
}
],
"source": {
"advisory": "GHSA-fh39-c73x-5pjv",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106105",
"datePublished": "2026-10-06T17:20:36.923Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T17:53:57.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106104 (GCVE-0-2026-106104)
Vulnerability from nvd – Published: 2026-10-06 17:14 – Updated: 2026-10-06 17:14
VLAI
EPSS
VEX
Title
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.
Severity
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.3
|
{
"containers": {
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:14:45.817Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
},
{
"name": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
}
],
"source": {
"advisory": "GHSA-68jq-fhch-4xq4",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106104",
"datePublished": "2026-10-06T17:14:45.817Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T17:14:45.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106103 (GCVE-0-2026-106103)
Vulnerability from nvd – Published: 2026-10-06 17:11 – Updated: 2026-10-06 19:42
VLAI
EPSS
VEX
Title
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:42 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.22.0
|
|
| @quasar | icongenie |
Affected:
< 6.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:42:43.611562Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:42:52.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.22.0"
}
]
},
{
"product": "icongenie",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 6.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:11:03.821Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-wmpw-j6qv-mw88",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-wmpw-j6qv-mw88"
},
{
"name": "https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1"
}
],
"source": {
"advisory": "GHSA-wmpw-j6qv-mw88",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106103",
"datePublished": "2026-10-06T17:11:03.821Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:42:52.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106102 (GCVE-0-2026-106102)
Vulnerability from nvd – Published: 2026-10-06 17:07 – Updated: 2026-10-06 17:39
VLAI
EPSS
VEX
Title
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:38 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.22.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:38:06.088426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:39:02.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:07:55.498Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-pq96-jpmf-w254",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-pq96-jpmf-w254"
},
{
"name": "https://github.com/quasarframework/quasar/commit/11505afe5b5218f2c468f130181815b898fd1e40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/11505afe5b5218f2c468f130181815b898fd1e40"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
}
],
"source": {
"advisory": "GHSA-pq96-jpmf-w254",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106102",
"datePublished": "2026-10-06T17:07:55.498Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T17:39:02.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106101 (GCVE-0-2026-106101)
Vulnerability from nvd – Published: 2026-10-06 17:04 – Updated: 2026-10-06 17:26
VLAI
EPSS
VEX
Title
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:24 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.32.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106101",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:24:41.442349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:26:21.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.32.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:04:39.673Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
},
{
"name": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
}
],
"source": {
"advisory": "GHSA-89vp-x45c-52cq",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106101",
"datePublished": "2026-10-06T17:04:39.673Z",
"dateReserved": "2026-10-06T15:33:55.332Z",
"dateUpdated": "2026-10-06T17:26:21.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73647 (GCVE-0-2026-73647)
Vulnerability from nvd – Published: 2026-08-13 17:57 – Updated: 2026-08-13 18:41
VLAI
EPSS
VEX
Title
Quasar Framework: Prototype pollution in Quasar extend() utility
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
Severity
5.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 18:41 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.22.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73647",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T18:41:13.711876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T18:41:21.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:57:09.014Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
},
{
"name": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
}
],
"source": {
"advisory": "GHSA-3r53-75j5-3g7j",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Prototype pollution in Quasar extend() utility"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73647",
"datePublished": "2026-08-13T17:57:09.014Z",
"dateReserved": "2026-08-13T14:04:09.604Z",
"dateUpdated": "2026-08-13T18:41:21.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106109 (GCVE-0-2026-106109)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:32 – Updated: 2026-10-06 19:43
VLAI
EPSS
VEX
Title
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:43 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
>= 2.7.0, < 2.23.3
|
|
| @quasar | app-vite |
Affected:
>= 1.0.0, < 3.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:43:25.036654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:43:35.076Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.7.0, \u003c 2.23.3"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:32:08.136Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93"
},
{
"name": "https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-q9mq-245r-4g93",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106109",
"datePublished": "2026-10-06T17:32:08.136Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:43:35.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106107 (GCVE-0-2026-106107)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:26 – Updated: 2026-10-06 19:29
VLAI
EPSS
VEX
Title
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:25 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.4
|
|
| @quasar | app-vite |
Affected:
< 3.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:25:52.348218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:29:55.266Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.4"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:26:19.769Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7"
},
{
"name": "https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-5m6h-8g35-p3m7",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106107",
"datePublished": "2026-10-06T17:26:19.769Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:29:55.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106106 (GCVE-0-2026-106106)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:24 – Updated: 2026-10-06 18:22
VLAI
EPSS
VEX
Title
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 18:22 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.3
|
|
| @quasar | render-ssr-error |
Affected:
< 2.2.4
|
|
| @quasar | app-vite |
Affected:
< 3.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106106",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T18:22:31.217011Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T18:22:44.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.3"
}
]
},
{
"product": "render-ssr-error",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.4"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer\u0027s request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-497",
"description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:24:07.788Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
},
{
"name": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
}
],
"source": {
"advisory": "GHSA-r5mf-4r5x-q78f",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106106",
"datePublished": "2026-10-06T17:24:07.788Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T18:22:44.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106105 (GCVE-0-2026-106105)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:20 – Updated: 2026-10-06 17:53
VLAI
EPSS
VEX
Title
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:53 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.3
|
|
| @quasar | app-vite |
Affected:
< 3.3.0
|
|
| @quasar | cli |
Affected:
< 5.0.4
|
|
| @quasar | ssl-certificate |
Affected:
< 2.1.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:53:50.770402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:53:57.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.3"
}
]
},
{
"product": "app-vite",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 3.3.0"
}
]
},
{
"product": "cli",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.4"
}
]
},
{
"product": "ssl-certificate",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:20:36.923Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv"
},
{
"name": "https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4"
}
],
"source": {
"advisory": "GHSA-fh39-c73x-5pjv",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106105",
"datePublished": "2026-10-06T17:20:36.923Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T17:53:57.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106104 (GCVE-0-2026-106104)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:14 – Updated: 2026-10-06 17:14
VLAI
EPSS
VEX
Title
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.
Severity
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.23.3
|
{
"containers": {
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.23.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:14:45.817Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-68jq-fhch-4xq4"
},
{
"name": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/7a954ddafa756afe95c8f633f48ed68a07209d3d"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.23.3"
}
],
"source": {
"advisory": "GHSA-68jq-fhch-4xq4",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106104",
"datePublished": "2026-10-06T17:14:45.817Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T17:14:45.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106103 (GCVE-0-2026-106103)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:11 – Updated: 2026-10-06 19:42
VLAI
EPSS
VEX
Title
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:42 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.22.0
|
|
| @quasar | icongenie |
Affected:
< 6.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:42:43.611562Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:42:52.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.22.0"
}
]
},
{
"product": "icongenie",
"vendor": "@quasar",
"versions": [
{
"status": "affected",
"version": "\u003c 6.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:11:03.821Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-wmpw-j6qv-mw88",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-wmpw-j6qv-mw88"
},
{
"name": "https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1"
}
],
"source": {
"advisory": "GHSA-wmpw-j6qv-mw88",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106103",
"datePublished": "2026-10-06T17:11:03.821Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T19:42:52.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106102 (GCVE-0-2026-106102)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:07 – Updated: 2026-10-06 17:39
VLAI
EPSS
VEX
Title
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:38 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.22.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:38:06.088426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:39:02.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:07:55.498Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-pq96-jpmf-w254",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-pq96-jpmf-w254"
},
{
"name": "https://github.com/quasarframework/quasar/commit/11505afe5b5218f2c468f130181815b898fd1e40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/11505afe5b5218f2c468f130181815b898fd1e40"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
}
],
"source": {
"advisory": "GHSA-pq96-jpmf-w254",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106102",
"datePublished": "2026-10-06T17:07:55.498Z",
"dateReserved": "2026-10-06T15:33:55.333Z",
"dateUpdated": "2026-10-06T17:39:02.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106101 (GCVE-0-2026-106101)
Vulnerability from cvelistv5 – Published: 2026-10-06 17:04 – Updated: 2026-10-06 17:26
VLAI
EPSS
VEX
Title
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:24 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.32.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106101",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:24:41.442349Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:26:21.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.32.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:04:39.673Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq"
},
{
"name": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/52d874bf55309dd3656fb02aed033ab025d477ec"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2"
}
],
"source": {
"advisory": "GHSA-89vp-x45c-52cq",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106101",
"datePublished": "2026-10-06T17:04:39.673Z",
"dateReserved": "2026-10-06T15:33:55.332Z",
"dateUpdated": "2026-10-06T17:26:21.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73647 (GCVE-0-2026-73647)
Vulnerability from cvelistv5 – Published: 2026-08-13 17:57 – Updated: 2026-08-13 18:41
VLAI
EPSS
VEX
Title
Quasar Framework: Prototype pollution in Quasar extend() utility
Summary
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
Severity
5.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 18:41 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/quasarframework/quasar/securit… | x_refsource_CONFIRM |
| https://github.com/quasarframework/quasar/commit/… | x_refsource_MISC |
| https://github.com/quasarframework/quasar/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| quasarframework | quasar |
Affected:
< 2.22.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73647",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T18:41:13.711876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T18:41:21.421Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "quasar",
"vendor": "quasarframework",
"versions": [
{
"status": "affected",
"version": "\u003c 2.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:57:09.014Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
},
{
"name": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
},
{
"name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
}
],
"source": {
"advisory": "GHSA-3r53-75j5-3g7j",
"discovery": "UNKNOWN"
},
"title": "Quasar Framework: Prototype pollution in Quasar extend() utility"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73647",
"datePublished": "2026-08-13T17:57:09.014Z",
"dateReserved": "2026-08-13T14:04:09.604Z",
"dateUpdated": "2026-08-13T18:41:21.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}