Vulnerability-Lookup

GHSA-R5MF-4R5X-Q78F

Vulnerability from github – Published: 2026-10-07 16:16 – Updated: 2026-10-07 16:16

Summary

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Details

Summary

The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a <script> element behind a replaceAll('</script>', ...) guard that is ASCII-case-sensitive and requires a literal >, so </SCRIPT>, </script > and </script/> all escape the element and give script execution in the dev server's origin.

Details

renderSSRError() builds the page by splicing a JSON blob into a prebuilt bundle (utils/render-ssr-error/src/index.js):

errorHtml:
  before +
  JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) +
  after

before and after are the two halves of the compiled error-page UI, split inside a <script type="module"> element, so data is emitted as a JS object literal in raw script text. The data itself comes from utils/render-ssr-error/src/env.js:

function getEnvironmentVariablesData () {
  return Object.keys(process.env).reduce((acc, name) => {
    acc[ name ] = process.env[ name ]
    return acc
  }, {})
}

export function getEnv (req) {
  return {
    Request: getRequestData(req),
    Headers: getHeadersData(req),
    Cookies: getCookiesData(req),
    'Shell environment variables': getEnvironmentVariablesData()
  }
}

The page is served by serve.devError({ err, req }) in app-vite/lib/modes/ssr/ssr-devserver.js and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because app-vite/lib/quasar-config-file.js overrides Vite's localhost default:

} else if (!cfg.devServer.host) {
  cfg.devServer.host = '0.0.0.0'
}

The escape fails because the HTML tokenizer ends script raw text on </ followed by a case-insensitive script followed by any of tab, newline, form feed, space, / or >. replaceAll with a string pattern matches one exact spelling. </SCRIPT>, </ScRiPt>, </script > and </script/> are all untouched and all close the element. JSON.stringify does not escape < or >, and cookie values are additionally run through decodeURIComponent before being placed in the blob, so percent-encoded payloads decode into working markup.

The project already implements this correctly elsewhere. ui/src/plugins/meta/Meta.js uses a case-insensitive pattern with no trailing >:

function protectRawText (value, tagName) {
  return String(value).replaceAll(new RegExp(`</${tagName}`, 'gi'), `<\\/${tagName}`)
}

PoC

Harness that replicates the dev server's error branch using the published @quasar/render-ssr-error@2.2.3, with two canary values planted in the environment:

import http from 'node:http'
import renderSSRError from '@quasar/render-ssr-error'

process.env.AWS_SECRET_ACCESS_KEY = 'CANARY_AWS_SECRET_dev_machine_9f3a1c'
process.env.NPM_TOKEN = 'CANARY_npm_TOKEN_abcdef'

http.createServer((req, res) => {
  const err = new Error('Cannot read properties of undefined (reading "x")')
  const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() })
  res.writeHead(500, errorHeaders)
  res.end(errorHtml)
}).listen(3200, '0.0.0.0')

Disclosure needs no payload at all. A plain GET / returns a 957 KB page containing both canaries:

ENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page
  -> CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef

For the injection, the payload goes in an ordinary request header. JSON.stringify escapes " as \", so the handler uses single quotes:

<TAG><img src=/nonexistent-image onerror='window.__QPWN=document.domain+":"+location.port'>

Loaded in headless Chromium:

POSITIVE  </SCRIPT >  (uppercase + space)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
POSITIVE  </script >  (lowercase + space)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
POSITIVE  </script/>  (lowercase + slash)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
POSITIVE  </ScRiPt>   (mixed case)          window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED
NEG-CTRL  </script>   (what the filter matches)
                                            window.__QPWN=null            injectedImg=0  no execution

The negative control is the same payload with the one spelling replaceAll actually matches. Nothing is injected and nothing runs, which isolates the bug to the escape rather than to the surrounding page. Confirming the injection context, a probe header comes back inside the single <script type="module"> element:

..."Headers":{"host":"127.0.0.1:3200","user-agent":"curl/8.18.0","accept":"*/*",
   "x-probe":"</SCRIPT ><img src=/nope onerror=\"window.__QPWN=1\">MARKEREND"},...

No Content-Security-Policy is sent with the page.

Impact

Exposure of sensitive system information, plus HTML injection into a page that carries it. This is development only, since serve.devError does not exist in a production build, and it requires the app's SSR render to throw. That is the routine state this page exists to display, and an attacker who can reach the port can simply poll for it.

The disclosure is the substantive half and needs nothing but a TCP connection: shell environment, all request headers, all cookies, and ten lines of source around every stack frame. On a developer machine that typically means cloud credentials, npm or GitHub tokens and database connection strings. Because Quasar overrides Vite's localhost default with 0.0.0.0, everyone on the same network segment or in a shared container network can ask for it.

The injection is best treated as a chained issue on top of that rather than as a drive-by. A raw HTTP client can set the header but only poisons its own page. For the code to run in the developer's browser the payload has to travel with the developer's own request, which in practice means the cookie channel, since cookie values are URL-decoded and any page on a localhost or 127.0.0.1 origin can set a cookie that is sent to every port on that host. Cross-origin fetch does not work: CORS-safelisted headers forbid < and >, and browsers percent-encode them in the URL while req.url is never decoded.

Fixing the escape alone leaves the disclosure. Serializing with something that escapes <, such as the serialize-javascript already used correctly in app-vite/lib/modes/ssr/ssr-utils.js, closes the injection; redacting or omitting process.env and cookie values closes the disclosure; defaulting devServer.host to localhost as Vite does would reduce who can ask.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.2.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@quasar/render-ssr-error"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.2.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@quasar/app-vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106106"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-497",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T16:16:12Z",
    "nvd_published_at": "2026-10-06T18:16:52Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer\u0027s cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `\u003cscript\u003e` element behind a `replaceAll(\u0027\u003c/script\u003e\u0027, ...)` guard that is ASCII-case-sensitive and requires a literal `\u003e`, so `\u003c/SCRIPT\u003e`, `\u003c/script \u003e` and `\u003c/script/\u003e` all escape the element and give script execution in the dev server\u0027s origin.\n\n### Details\n\n`renderSSRError()` builds the page by splicing a JSON blob into a prebuilt bundle (`utils/render-ssr-error/src/index.js`):\n\n```js\nerrorHtml:\n  before +\n  JSON.stringify(data).replaceAll(\u0027\u003c/script\u003e\u0027, String.raw`\u003c\\/script\u003e`) +\n  after\n```\n\n`before` and `after` are the two halves of the compiled error-page UI, split inside a `\u003cscript type=\"module\"\u003e` element, so `data` is emitted as a JS object literal in raw script text. The data itself comes from `utils/render-ssr-error/src/env.js`:\n\n```js\nfunction getEnvironmentVariablesData () {\n  return Object.keys(process.env).reduce((acc, name) =\u003e {\n    acc[ name ] = process.env[ name ]\n    return acc\n  }, {})\n}\n\nexport function getEnv (req) {\n  return {\n    Request: getRequestData(req),\n    Headers: getHeadersData(req),\n    Cookies: getCookiesData(req),\n    \u0027Shell environment variables\u0027: getEnvironmentVariablesData()\n  }\n}\n```\n\nThe page is served by `serve.devError({ err, req })` in `app-vite/lib/modes/ssr/ssr-devserver.js` and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because `app-vite/lib/quasar-config-file.js` overrides Vite\u0027s `localhost` default:\n\n```js\n} else if (!cfg.devServer.host) {\n  cfg.devServer.host = \u00270.0.0.0\u0027\n}\n```\n\nThe escape fails because the HTML tokenizer ends script raw text on `\u003c/` followed by a case-insensitive `script` followed by any of tab, newline, form feed, space, `/` or `\u003e`. `replaceAll` with a string pattern matches one exact spelling. `\u003c/SCRIPT\u003e`, `\u003c/ScRiPt\u003e`, `\u003c/script \u003e` and `\u003c/script/\u003e` are all untouched and all close the element. `JSON.stringify` does not escape `\u003c` or `\u003e`, and cookie values are additionally run through `decodeURIComponent` before being placed in the blob, so percent-encoded payloads decode into working markup.\n\nThe project already implements this correctly elsewhere. `ui/src/plugins/meta/Meta.js` uses a case-insensitive pattern with no trailing `\u003e`:\n\n```js\nfunction protectRawText (value, tagName) {\n  return String(value).replaceAll(new RegExp(`\u003c/${tagName}`, \u0027gi\u0027), `\u003c\\\\/${tagName}`)\n}\n```\n\n### PoC\n\nHarness that replicates the dev server\u0027s error branch using the published `@quasar/render-ssr-error@2.2.3`, with two canary values planted in the environment:\n\n```js\nimport http from \u0027node:http\u0027\nimport renderSSRError from \u0027@quasar/render-ssr-error\u0027\n\nprocess.env.AWS_SECRET_ACCESS_KEY = \u0027CANARY_AWS_SECRET_dev_machine_9f3a1c\u0027\nprocess.env.NPM_TOKEN = \u0027CANARY_npm_TOKEN_abcdef\u0027\n\nhttp.createServer((req, res) =\u003e {\n  const err = new Error(\u0027Cannot read properties of undefined (reading \"x\")\u0027)\n  const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() })\n  res.writeHead(500, errorHeaders)\n  res.end(errorHtml)\n}).listen(3200, \u00270.0.0.0\u0027)\n```\n\nDisclosure needs no payload at all. A plain `GET /` returns a 957 KB page containing both canaries:\n\n```\nENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page\n  -\u003e CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef\n```\n\nFor the injection, the payload goes in an ordinary request header. `JSON.stringify` escapes `\"` as `\\\"`, so the handler uses single quotes:\n\n```\n\u003cTAG\u003e\u003cimg src=/nonexistent-image onerror=\u0027window.__QPWN=document.domain+\":\"+location.port\u0027\u003e\n```\n\nLoaded in headless Chromium:\n\n```\nPOSITIVE  \u003c/SCRIPT \u003e  (uppercase + space)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED\nPOSITIVE  \u003c/script \u003e  (lowercase + space)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED\nPOSITIVE  \u003c/script/\u003e  (lowercase + slash)   window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED\nPOSITIVE  \u003c/ScRiPt\u003e   (mixed case)          window.__QPWN=127.0.0.1:3200  injectedImg=1  ATTACKER SCRIPT EXECUTED\nNEG-CTRL  \u003c/script\u003e   (what the filter matches)\n                                            window.__QPWN=null            injectedImg=0  no execution\n```\n\nThe negative control is the same payload with the one spelling `replaceAll` actually matches. Nothing is injected and nothing runs, which isolates the bug to the escape rather than to the surrounding page. Confirming the injection context, a probe header comes back inside the single `\u003cscript type=\"module\"\u003e` element:\n\n```\n...\"Headers\":{\"host\":\"127.0.0.1:3200\",\"user-agent\":\"curl/8.18.0\",\"accept\":\"*/*\",\n   \"x-probe\":\"\u003c/SCRIPT \u003e\u003cimg src=/nope onerror=\\\"window.__QPWN=1\\\"\u003eMARKEREND\"},...\n```\n\nNo `Content-Security-Policy` is sent with the page.\n\n### Impact\n\nExposure of sensitive system information, plus HTML injection into a page that carries it. This is development only, since `serve.devError` does not exist in a production build, and it requires the app\u0027s SSR render to throw. That is the routine state this page exists to display, and an attacker who can reach the port can simply poll for it.\n\nThe disclosure is the substantive half and needs nothing but a TCP connection: shell environment, all request headers, all cookies, and ten lines of source around every stack frame. On a developer machine that typically means cloud credentials, npm or GitHub tokens and database connection strings. Because Quasar overrides Vite\u0027s `localhost` default with `0.0.0.0`, everyone on the same network segment or in a shared container network can ask for it.\n\nThe injection is best treated as a chained issue on top of that rather than as a drive-by. A raw HTTP client can set the header but only poisons its own page. For the code to run in the developer\u0027s browser the payload has to travel with the developer\u0027s own request, which in practice means the cookie channel, since cookie values are URL-decoded and any page on a `localhost` or `127.0.0.1` origin can set a cookie that is sent to every port on that host. Cross-origin `fetch` does not work: CORS-safelisted headers forbid `\u003c` and `\u003e`, and browsers percent-encode them in the URL while `req.url` is never decoded.\n\nFixing the escape alone leaves the disclosure. Serializing with something that escapes `\u003c`, such as the `serialize-javascript` already used correctly in `app-vite/lib/modes/ssr/ssr-utils.js`, closes the injection; redacting or omitting `process.env` and cookie values closes the disclosure; defaulting `devServer.host` to `localhost` as Vite does would reduce who can ask.",
  "id": "GHSA-r5mf-4r5x-q78f",
  "modified": "2026-10-07T16:16:12Z",
  "published": "2026-10-07T16:16:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106106"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quasarframework/quasar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable"
}

CVE-2026-106106 (GCVE-0-2026-106106)

Vulnerability from cvelistv5 – Published: 2026-10-06 17:24 – Updated: 2026-10-06 18:22

Title

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 18:22 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/quasarframework/quasar/securit…	x_refsource_CONFIRM
https://github.com/quasarframework/quasar/commit/…	x_refsource_MISC
https://github.com/quasarframework/quasar/release…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
quasarframework	quasar	Affected: < 2.23.3
@quasar	render-ssr-error	Affected: < 2.2.4
@quasar	app-vite	Affected: < 3.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106106",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T18:22:31.217011Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T18:22:44.948Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.23.3"
            }
          ]
        },
        {
          "product": "render-ssr-error",
          "vendor": "@quasar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.2.4"
            }
          ]
        },
        {
          "product": "app-vite",
          "vendor": "@quasar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer\u0027s request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T17:24:07.788Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
        },
        {
          "name": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15"
        },
        {
          "name": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r5mf-4r5x-q78f",
        "discovery": "UNKNOWN"
      },
      "title": "Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106106",
    "datePublished": "2026-10-06T17:24:07.788Z",
    "dateReserved": "2026-10-06T15:33:55.333Z",
    "dateUpdated": "2026-10-06T18:22:44.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-R5MF-4R5X-Q78F

Summary

Details

PoC

Impact

CVE-2026-106106 (GCVE-0-2026-106106)

Tags

Sightings

Nomenclature

Related by attack behaviour