Render Ssr Error
Monthly
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite before 3.3.0) serializes the developer's shell environment variables, request headers, and cookies into the HTML error page produced by serve.devError(), and because the dev server listens on all interfaces by default, any network-adjacent client that can provoke a render failure can read those secrets without authentication. The same page escaped only the exact lowercase '</script>' spelling, so case variants or alternate closing-tag delimiters reflected in diagnostic data can terminate the script element and inject markup; for that injected code to execute in a browser it must accompany the developer's own request, which is why user interaction and high attack complexity apply. The issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 (commit 61c2bd8, advisory GHSA-r5mf-4r5x-q78f); no public exploit identified at time of analysis, and production SSR builds are unaffected - this is a developer-workstation-scoped risk rather than a broad production threat.
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite before 3.3.0) serializes the developer's shell environment variables, request headers, and cookies into the HTML error page produced by serve.devError(), and because the dev server listens on all interfaces by default, any network-adjacent client that can provoke a render failure can read those secrets without authentication. The same page escaped only the exact lowercase '</script>' spelling, so case variants or alternate closing-tag delimiters reflected in diagnostic data can terminate the script element and inject markup; for that injected code to execute in a browser it must accompany the developer's own request, which is why user interaction and high attack complexity apply. The issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 (commit 61c2bd8, advisory GHSA-r5mf-4r5x-q78f); no public exploit identified at time of analysis, and production SSR builds are unaffected - this is a developer-workstation-scoped risk rather than a broad production threat.