EUVD-2026-93516
GHSA-89vp-x45c-52cq
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
AC:H for the stacked iOS-plus-HTML-rendering conditions, PR:N since no auth is specified, UI:R for the user-triggered openURL(), and A:L only (C:N/I:N) as the sole effect is disrupted URL opening.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.
AnalysisAI
On iOS builds of Quasar Framework (all versions prior to 2.32.2), the openURL() utility can be tricked into invoking attacker-controlled page content instead of the native SafariViewController bridge, breaking external navigation, login redirects, and payment redirects with a thrown TypeError. The trigger requires an app built for iOS (Cordova/Capacitor where Platform.is.ios is true) plus a QEditor, QSelect, or QChatMessage configured to render untrusted HTML that can define an element named 'SafariViewController'; a legitimate user must then attempt a URL-opening action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the app running in an iOS environment where Platform.is.ios is true (typically a Cordova/Capacitor Quasar build); (2) a QEditor, QSelect, or QChatMessage component configured to render attacker-controlled HTML, allowing injection of a named element with id/name 'SafariViewController'; and (3) a subsequent openURL() invocation by a legitimate user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite being a valid flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Quasar Framework dependency to version 2.32.2 or later, the release in which the hardened openURL() checks (typeof safariViewController?.isAvailable and .show) were introduced - see the advisory at https://github.com/quasarframework/quasar/security/advisories/GHSA-89vp-x45c-52cq and the tagged release at https://github.com/quasarframework/quasar/releases/tag/quasar-v2.32.2, with the underlying change in commit 52d874bf55309dd3656fb02aed033ab025d477ec. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side cross-site scripting in Quasar Framework's SSR meta plugin (versions prior to 2.22.0) allows remote attacker
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending
Insecure file permissions in Quasar's development TLS certificate utility (@quasar/ssl-certificate before 2.1.0, shipped
Cross-site scripting in @quasar/app-vite (Quasar Framework) SSR and SSG rendering paths prior to 3.3.0 allows HTML attri
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite be
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile
The @quasar/app-vite build tooling (versions 1.0.0 through pre-3.3.0) recursively deletes the resolved build.distDir pat
Share
External POC / Exploit Code
Leaving vuln.today