Unsafe nonce interpolation in Quasar app-vite SSR and SSG output
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Quasar Framework before 2.23.4 and @quasar/app-vite before 3.3.0 are affected. Several SSR and SSG rendering paths in @quasar/app-vite insert ssrContext.nonce unescaped into quoted HTML attributes, which is improper output escaping (CWE-116). If an application derives or overrides the nonce with attacker-controlled data, a quote can end the attribute and inject extra attributes or markup into development and production output. Base64 and base64url nonces are not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| quasarframework | quasar | before 2.23.4 | 2.23.4 | Patch available | CNA |
| @quasar | app-vite | before 3.3.0 | 3.3.0 | Patch available | CNA |
| — | @quasar/app-vite (npm) | before 3.3.0 | 3.3.0 | Patch available | GHSA-5m6h-8g35-p3m7 |
- quasar Vendorquasarframework Affected before 2.23.4 Fixed in 2.23.4 Patch available CNA
- app-vite Vendor@quasar Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA
- @quasar/app-vite (npm) Vendor— Affected before 3.3.0 Fixed in 3.3.0 Patch available GHSA-5m6h-8g35-p3m7
Remediation
Upgrade @quasar/app-vite to version 3.3.0. The sources list no fixed version for quasar.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA quasar (quasarframework) Fixed in 2.23.4
- Fix · CNA app-vite (@quasar) Fixed in 3.3.0
- Fix · GHSA-5m6h-8g35-p3m7 @quasar/app-vite (npm) Fixed in 3.3.0 Advisory →
Timeline
- 2026-10-06 Threatist record created from CVE-2026-106107
- 2026-10-07 Alias added: GHSA-5m6h-8g35-p3m7
- 2026-10-07 Fix available: npm/@quasar/[email protected] · GHSA-5m6h-8g35-p3m7
- 2026-10-07 CVSS score added · GHSA-5m6h-8g35-p3m7
- 2026-10-07 Weakness changed · GHSA-5m6h-8g35-p3m7
- 2026-10-07 5 new references · GHSA-5m6h-8g35-p3m7
References
More quasarframework vulnerabilities
- TI-2026-68624 Regex backtracking on User-Agent header stalls Quasar SSR servers CVSS 4.0HIGH 8.7
- TI-2026-68626 Quasar SSR dev error page leaks environment secrets and enables XSS CVSS 4.0HIGH 7.1
- TI-2026-51731 Quasar Framework: Prototype pollution in Quasar extend() utility CVSS 3.1MEDIUM 5.6
- TI-2026-68622 Cross-site scripting in Quasar Framework SSR meta tags CVSS 3.1CRITICAL 10.0
- TI-2026-68621 Type confusion in quasarframework quasar CVSS 3.1LOW 3.1
- TI-2026-68625 Quasar caches development TLS keys with lax file permissions CVSS 4.0HIGH 8.4
Sources
- CVE-2026-106107 · CVE Program
- CVE-2026-106107 · NVD
- FIRST EPSS
- GHSA-5m6h-8g35-p3m7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences