TI-2026-68622 Aliases CVE-2026-106102 GHSA-pq96-jpmf-w254

Cross-site scripting in Quasar Framework SSR meta tags

MEDIUM 49CWE-116Published 2026-10-06 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Quasar Framework versions from 0 before 2.22.0 do not encode values that useMeta() passes into server-side rendered title, meta, link, and script markup in getHead(). An attacker who can influence page metadata such as a post title or display name can break out of the intended HTML context and inject executable markup before hydration, which is cross-site scripting (CWE-79). The client-side apply() path is not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00299 22nd percentileScored 2026-11-07

Fix Fixed quasar (quasarframework): 2.22.0quasar (npm): 2.22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
quasarframework	quasar	before 2.22.0	2.22.0	Patch available	CNA
—	quasar (npm)	before 2.22.0	2.22.0	Patch available	GHSA-pq96-jpmf-w254

quasar Vendorquasarframework Affected before 2.22.0 Fixed in 2.22.0 Patch available CNA
quasar (npm) Vendor— Affected before 2.22.0 Fixed in 2.22.0 Patch available GHSA-pq96-jpmf-w254

Remediation

Upgrade the npm package quasar to version 2.22.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA quasar (quasarframework) Fixed in 2.22.0
Fix · GHSA-pq96-jpmf-w254 quasar (npm) Fixed in 2.22.0 Advisory →

Timeline

2026-10-06 Threatist record created from CVE-2026-106102
2026-10-07 Alias added: GHSA-pq96-jpmf-w254
2026-10-07 Fix available: npm/[email protected] · GHSA-pq96-jpmf-w254
2026-10-07 CVSS score added · GHSA-pq96-jpmf-w254
2026-10-07 Weakness changed · GHSA-pq96-jpmf-w254
2026-10-07 5 new references · GHSA-pq96-jpmf-w254

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-106102

Other 4

TI-2026-68624 Regex backtracking on User-Agent header stalls Quasar SSR servers CVSS 4.0HIGH 8.7
TI-2026-68626 Quasar SSR dev error page leaks environment secrets and enables XSS CVSS 4.0HIGH 7.1
TI-2026-51731 Quasar Framework: Prototype pollution in Quasar extend() utility CVSS 3.1MEDIUM 5.6
TI-2026-68621 Type confusion in quasarframework quasar CVSS 3.1LOW 3.1
TI-2026-68625 Quasar caches development TLS keys with lax file permissions CVSS 4.0HIGH 8.4
TI-2026-68627 Unsafe nonce interpolation in Quasar app-vite SSR and SSG output CVSS 4.0HIGH 8.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences