Impact

Successful exploitation of this vulnerability allows an attacker to inject arbitrary HTML attributes or elements into the rendered output of a Quasar application. Depending on the application's implementation and the injected content, this could lead to the execution of unauthorized JavaScript, manipulation of DOM structure, or the bypass of Content Security Policy (CSP) protections if the nonce mechanism is compromised. The vulnerability affects all versions of @quasar/app-vite up to and including 3.2.0.

Recommendation

• Update @quasar/app-vite to the latest version that implements centralized nonce handling, which enforces strict base64/base64url validation and HTML encoding of the nonce attribute.
• Audit existing applications using the Quasar framework to ensure that no untrusted user input is being passed into ssrContext.nonce within the server-side rendering configuration.
• Implement a robust Content Security Policy (CSP) that does not rely solely on dynamically generated nonces from potentially unsafe inputs if the application architecture cannot guarantee input sanitization.

Furthermore, the error page embeds this serialized data within a <script> element using a flawed string replacement routine (replaceAll('</script>', ...)). This filter is ASCII-case-sensitive and fails to identify variations such as </SCRIPT>, </script >, or </script/>, allowing an attacker to escape the script context and execute arbitrary JavaScript in the origin of the development server. This issue affects @quasar/render-ssr-error versions 2.2.3 and below, and @quasar/app-vite versions 3.2.0 and below.

Attack Chain

1. The attacker scans the network for development servers listening on Quasar's default ports or configured ports that are exposed via the 0.0.0.0 binding.
2. The attacker triggers a server-side rendering (SSR) or static site generation (SSG) error by sending a malformed request that causes the application logic to throw an exception.
3. The Quasar development server invokes renderSSRError, which collects the server's environment variables (including cloud credentials, tokens, and database strings) and request metadata.
4. The framework serializes this information into a 500 error response page.
5. The attacker retrieves the full environment dump via an unauthenticated GET request.
6. To achieve code execution, the attacker provides a malicious payload in an HTTP header or a cookie that, when processed by the disclosure page, breaks out of the script tag using an unescaped tag like </SCRIPT >.
7. The developer's browser renders the malicious script, allowing the attacker to execute code in the local dev environment context.

Impact

Successful exploitation allows for the unauthorized exfiltration of highly sensitive development credentials, including AWS secret keys, GitHub or NPM registry tokens, and database connection strings. By chaining the information disclosure with the HTML injection vulnerability, an attacker can also gain JavaScript execution within the developer's browser, potentially leading to session hijacking or local file interactions. This represents a significant risk for any organization utilizing Quasar in a networked development environment.

Recommendation

1. Upgrade affected projects to versions of @quasar/render-ssr-error and @quasar/app-vite that include the patch for CVE-2026-106106.
2. Ensure the development server is configured to bind to 127.0.0.1 rather than 0.0.0.0 to restrict access to the local machine.
3. Implement strict network segmentation for development environments to prevent unauthorized network access to local development ports.
4. Audit local development environments for potential credential leakage if the vulnerable version was previously exposed to any untrusted network segments.

Furthermore, the generated certificates were identified as having overly broad security parameters, including CA-capability and excessive key usage. An attacker with local filesystem access can read the cached private key and use it to impersonate a development TLS endpoint in environments where the certificate is trusted. This issue impacts several Quasar components, including the CLI and Vite application packages, which utilize this utility for local development environments. Remediation involves ensuring the cached PEM files are written with owner-only permissions and updating certificate generation logic to constrain key usage and remove CA-capability.

Impact

Successful exploitation allows a local attacker to obtain a valid private TLS key used in development environments. This enables the attacker to perform machine-in-the-middle attacks or impersonate local development services that rely on these certificates for trust. This risk is primarily relevant in multi-user development environments, shared build servers, or local workstations where malicious actors have already established a foothold or have legitimate local access.

Recommendation

Prioritize updating all instances of @quasar/ssl-certificate, @quasar/cli, and @quasar/app-vite to versions that address CVE-2026-106105. For environments where upgrades are delayed, implement strict local filesystem permission audits on development directories where Quasar projects reside.

The vulnerability exists because getHead() uses insecure template-literal interpolation to construct HTML strings without any HTML-entity or attribute-quote escaping. In contrast, the client-side apply() method uses safe DOM APIs (document.createElement and setAttribute) that handle escaping automatically. Because getHead() is a parallel, independent implementation for the SSR path, it remains vulnerable. An attacker can input strings containing HTML metacharacters (e.g., </title>, ", >) through any application input that eventually populates useMeta(), resulting in the injection of arbitrary malicious markup, including <script> tags, into the server-rendered HTML response.

Attack Chain

1. Attacker identifies an application input field (e.g., blog post title, user display name, or CMS field) that is processed and rendered by the Quasar SSR useMeta() composable.
2. Attacker submits a payload containing malicious HTML characters, such as My Post</title><script>alert(document.cookie)</script>.
3. The application backend stores this malicious string in the database or passes it to the SSR rendering pipeline.
4. A victim requests the page, triggering the Quasar SSR getHead() utility on the server.
5. The getHead() function serializes the malicious payload into the raw HTML <head> segment without escaping characters.
6. The server sends the unsanitized HTML response to the victim's browser.
7. The browser parses the injected <script> tag before hydration, executing the attacker-supplied JavaScript in the context of the site origin.
8. The script performs malicious actions such as exfiltrating document.cookie or overlaying phishing content.

Impact

Successful exploitation allows for reflected or stored Cross-Site Scripting (XSS). This gives the attacker the ability to steal user session cookies, perform unauthorized actions on behalf of the user, modify the page content, or redirect users to malicious domains. The vulnerability is highly impactful because useMeta() is a primary and common component used in almost all dynamic Quasar SSR applications, making a wide range of content-heavy sites potentially susceptible to trivial exploitation.

Recommendation

Prioritized actions for development and security engineering teams:

• Update the Quasar Framework to version 2.22.0 or later immediately to patch CVE-2026-106102.
• Audit existing SSR implementations for useMeta() usage where user-controlled input might be processed and rendered server-side.
• Implement a rigorous server-side HTML-escaping routine for all metadata attributes if an immediate framework update is not possible.