Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M
CVE-2026-106102Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Critical 10.0
In plain English
A critical-severity cross-site scripting in quasar from quasarframework. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | quasar | 2.22.0 | GHSA-pq96-jpmf-w254 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| quasarframework | quasar | < 2.22.0 |
Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N