Which versions of @quasar/app-vite are affected by CVE-2026-106107?

@quasar/app-vite, the build tooling behind Quasar Framework server-side and static site rendering, contains a high-severity cross-site scripting flaw in versions prior to 3.3.0 that can allow…. A patch is available.

How to fix or mitigate CVE-2026-106107?

Within 24 hours, inventory all applications built with @quasar/app-vite and identify any SSR or SSG code path that overrides or derives ssrContext.nonce from user-supplied data; where such customizations exist, immediately revert to Quasar's default cryptographically generated base64/base64url nonce as a stopgap and search source and git history for the pattern. Within 7 days, upgrade every affected project to @quasar/app-vite 3.3.0 or later, rebuild and redeploy SSR/SSG bundles, verify the resolved version in lockfiles and build output, and confirm no application code reassigns ssrContext.nonce after upgrade. Within 30 days, add automated dependency-version and nonce-handling checks to CI pipelines, require security review for any server-rendered template changes that touch nonce or header handling, and complete a verification sweep confirming all production and staging environments run 3.3.0 or later.

@quasar/app-vite CVE-2026-106107

Q: What is the CVSS score of CVE-2026-106107?

CVE-2026-106107 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-93572 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-06 GitHub_M

GHSA-5m6h-8g35-p3m7

XSS Quasar App Vite

8.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

AC:H because exploitation depends on a non-default insecure nonce-derivation configuration; PR:N as the attacker is unauthenticated; UI:R and S:C as injected markup executes in a victim browser.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Oct 06, 2026 - 19:21 vuln.today

Patch available

Oct 06, 2026 - 19:04 EUVD

Analysis Generated

Oct 06, 2026 - 18:06 vuln.today

CVE Published

Oct 06, 2026 - 17:26 cve.org

HIGH 8.3

DescriptionCVE.org

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.

AnalysisAI

Cross-site scripting in @quasar/app-vite (Quasar Framework) SSR and SSG rendering paths prior to 3.3.0 allows HTML attribute and markup injection when an application derives or overrides ssrContext.nonce from attacker-controllable data instead of relying on Quasar's default cryptographically generated base64/base64url nonce. The flaw is exploitable remotely and unauthenticated in the sense that no privileges are required on the server side (CVSS PR:N), but it is inert under default configuration: a quote character must survive into the nonce value, and the poisoned server-rendered page must then be loaded by a victim, so exploitability is contingent on the application's own nonce handling (independent assessment rates it AV:N/AC:H and requires user interaction). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the application explicitly derive or override ssrContext.nonce from attacker-controllable data (e.g., a request header or user parameter) instead of using Quasar's default cryptographically generated base64/base64url nonce; applications using the default nonce generation are NOT exploitable because such values contain no HTML attribute delimiters. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a CWE-79 XSS in @quasar/app-vite SSR/SSG rendering paths that interpolate ssrContext.nonce into quoted HTML attributes without escaping. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: @quasar/app-vite 3.3.0 and later. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all applications built with @quasar/app-vite and identify any SSR or SSG code path that overrides or derives ssrContext.nonce from user-supplied data; where such customizations exist, immediately revert to Quasar's default cryptographically generated base64/base64url nonce as a stopgap and search source and git history for the pattern. …

Threat intelligence, references, and detailed analysis are available after sign-in.