EUVD-2026-93571
GHSA-r5mf-4r5x-q78f
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent dev server (AV:A), must force a render failure (AC:H), no auth (PR:N); XSS needs the developer's request (UI:R); injection into the dev browser changes scope (S:C); secrets leak (C:H), markup injection (I:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
AnalysisAI
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite before 3.3.0) serializes the developer's shell environment variables, request headers, and cookies into the HTML error page produced by serve.devError(), and because the dev server listens on all interfaces by default, any network-adjacent client that can provoke a render failure can read those secrets without authentication. The same page escaped only the exact lowercase '</script>' spelling, so case variants or alternate closing-tag delimiters reflected in diagnostic data can terminate the script element and inject markup; for that injected code to execute in a browser it must accompany the developer's own request, which is why user interaction and high attack complexity apply. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: the Quasar development server must be running (this is a development-only error path - production SSR builds are unaffected); the dev server must be reachable by the attacker, which is the default because it listens on all interfaces; the attacker must be network-adjacent (AV:A), not arbitrarily remote across the internet; and the attacker must trigger an actual SSR or SSG render failure to reach serve.devError(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority, developer-workstation-scoped issue rather than a broad production threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @quasar/render-ssr-error to 2.2.4 and @quasar/app-vite to 3.3.0 - the fix is commit 61c2bd8a607785fdade72cce20e8faf1de7eee15, documented in advisory GHSA-r5mf-4r5x-q78f and the @quasar/app-vite-v3.3.0 release tag. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory development workstations and CI runners using @quasar/render-ssr-error before 2.2.4 or @quasar/app-vite before 3.3.0, restrict any dev server to localhost or trusted networks, block inbound access to development ports, and rotate any secrets, cookies, or tokens that may have been exposed through rendered error pages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today