EUVD-2026-93572
GHSA-5m6h-8g35-p3m7
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation depends on a non-default insecure nonce-derivation configuration; PR:N as the attacker is unauthenticated; UI:R and S:C as injected markup executes in a victim browser.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
AnalysisAI
Cross-site scripting in @quasar/app-vite (Quasar Framework) SSR and SSG rendering paths prior to 3.3.0 allows HTML attribute and markup injection when an application derives or overrides ssrContext.nonce from attacker-controllable data instead of relying on Quasar's default cryptographically generated base64/base64url nonce. The flaw is exploitable remotely and unauthenticated in the sense that no privileges are required on the server side (CVSS PR:N), but it is inert under default configuration: a quote character must survive into the nonce value, and the poisoned server-rendered page must then be loaded by a victim, so exploitability is contingent on the application's own nonce handling (independent assessment rates it AV:N/AC:H and requires user interaction). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application explicitly derive or override ssrContext.nonce from attacker-controllable data (e.g., a request header or user parameter) instead of using Quasar's default cryptographically generated base64/base64url nonce; applications using the default nonce generation are NOT exploitable because such values contain no HTML attribute delimiters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-79 XSS in @quasar/app-vite SSR/SSG rendering paths that interpolate ssrContext.nonce into quoted HTML attributes without escaping. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: @quasar/app-vite 3.3.0 and later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications built with @quasar/app-vite and identify any SSR or SSG code path that overrides or derives ssrContext.nonce from user-supplied data; where such customizations exist, immediately revert to Quasar's default cryptographically generated base64/base64url nonce as a stopgap and search source and git history for the pattern. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Insecure file permissions in Quasar's development TLS certificate utility (@quasar/ssl-certificate before 2.1.0, shipped
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite be
The @quasar/app-vite build tooling (versions 1.0.0 through pre-3.3.0) recursively deletes the resolved build.distDir pat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today