Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106101— Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

Quick assessment

Affected
quasarframework quasar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quasar 框架是一个用于构建高性能 Vue.js 用户界面的框架。在 2.32.2 版本之前， 中的 工具函数在 iOS 环境中只要检测到全局变量 存在，就会信任该对象。攻击者可以通过 等组件渲染受控的 HTML，从而创建一个名为 的 DOM 元素，导致浏览器的命名属性解析机制替换掉原本期望的原生桥接对象。后续调用 时，会尝试对该元素调用 方法，进而抛出 异常，从而破坏外部导航、登录重定向、支付重定向及其他依赖 URL 打开的工作流程。此外，当 和 配置为渲染 HTML 并处理攻击者可控的 HTML 内容时，也

CVSS 3.1 · Low

Possible ATT&CK Techniques 1 AI

T1505.003 · Web Shell

Affected Version Matrix 1

VendorProduct Version RangeStatus
quasarframework quasar < 2.32.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106101

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用不兼容类型访问资源(类型混淆)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
quasarframework quasar < 2.32.2 -

II. Public POCs for CVE-2026-106101

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106101

请登录查看更多情报信息。

Other References for CVE-2026-106101 (3)

Same Patch Batch · quasarframework · 2026-10-06 · 8 CVEs total

CVE-2026-106102 10.0 CRITICAL Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
CVE-2026-106104 8.7 HIGH Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Q
CVE-2026-106105 8.4 HIGH Quasar Framework: Development TLS private keys are cached with overly permissive filesyste
CVE-2026-106107 8.3 HIGH Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
CVE-2026-106103 7.1 HIGH Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
CVE-2026-106106 7.1 HIGH Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </sc
CVE-2026-106109 4.1 MEDIUM Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output d

IV. Related Vulnerabilities

Same product: quasar
Same vendor: quasarframework
Same weakness: CWE-843

V. Comments for CVE-2026-106101

No comments yet

Leave a comment