EUVD-2026-93517
GHSA-pq96-jpmf-w254
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Remote unencoded injection reachable without attacker privilege (PR:N) and crossing into the victim's browser (S:C, C/I:H), but a victim must load the page, so UI:R rather than the vendor's UI:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
AnalysisAI
Server-side cross-site scripting in Quasar Framework's SSR meta plugin (versions prior to 2.22.0) allows remote attackers who can influence dynamic page metadata - such as a post title, product name, excerpt, or display name - to inject executable markup into the server-rendered HTML before hydration. The flaw is in the getHead() serializer, which interpolates values supplied through useMeta() into title, meta, link, and script tags without HTML text or quoted-attribute encoding, while the client-side apply() path is unaffected because it relies on DOM APIs that encode attributes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to run Quasar in SSR (server-side rendering) mode AND to feed attacker-influenceable data (post title, product name, excerpt, or display name) into useMeta() title/meta/link/script fields without prior sanitization; the client-side-rendered (apply()) path is NOT exploitable because it uses DOM APIs that encode attributes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-severity server-side XSS (CWE-79) in Quasar's SSR meta serializer, but the input CVSS of 10.0 overstates the universal real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Quasar Framework 2.22.0 (release tag quasar-v2.22.0, commit 11505afe5b5218f2c468f130181815b898fd1e40), which encodes text and quoted attributes, escapes dangerous characters in the inline JSON, neutralizes raw script/noscript content, and validates attribute names. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application running Quasar Framework, confirm which of them operate in SSR mode on versions prior to 2.22.0, and identify each code path that passes user-influenceable data (post titles, product names, excerpts, display names) into useMeta(); for any confirmed exposure, either temporarily disable SSR for the affected routes or apply output encoding/sanitization at the metadata boundary before values reach title, meta, link, or script serialization, and verify that a restrictive Content-Security-Policy and WAF signatures are in place. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending
Insecure file permissions in Quasar's development TLS certificate utility (@quasar/ssl-certificate before 2.1.0, shipped
Cross-site scripting in @quasar/app-vite (Quasar Framework) SSR and SSG rendering paths prior to 3.3.0 allows HTML attri
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite be
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile
The @quasar/app-vite build tooling (versions 1.0.0 through pre-3.3.0) recursively deletes the resolved build.distDir pat
On iOS builds of Quasar Framework (all versions prior to 2.32.2), the openURL() utility can be tricked into invoking att
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today