Skip to content
Threat Feed
Subscribe

Vendor

Quasar

4 briefs RSS
high advisory

Quasar Framework App Vite SSR and SSG Nonce Attribute Injection

The @quasar/app-vite package (<= 3.2.0) is vulnerable to attribute injection in SSR and SSG renderer paths where unsanitized nonce values can be used to inject arbitrary HTML attributes.

app-vite web-vulnerability injection quasar cve-2026-106107
1t 1c
high advisory

Quasar Framework SSR/SSG Development Server Information Disclosure and HTML Injection

The Quasar Framework development server exposes environment variables, cookies, and request headers via an unauthenticated error page that is also susceptible to HTML injection due to an incomplete sanitization routine.

@quasar/render-ssr-error +1 vulnerability cve web-application quasar
2t 1c
high advisory

Insecure Local TLS Private Key Storage in Quasar Framework

The @quasar/ssl-certificate development utility caches TLS private keys with overly permissive filesystem permissions, enabling local unauthorized access and impersonation of development endpoints.

@quasar/ssl-certificate +2 credential-access development-tooling
1t 1c
high advisory

Stored/Reflected XSS in Quasar Framework SSR via Unescaped Meta Tag Rendering

The Quasar Framework's server-side rendering (SSR) mechanism in versions prior to 2.22.0 fails to escape HTML characters in meta tags, allowing attackers to inject and execute arbitrary JavaScript in the victim's browser.

Quasar Framework
2t 1c