Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106107— Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quick assessment

Affected
quasarframework quasar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quasar 框架是一个用于构建高性能 Vue.js 用户界面的框架。在 3.3.0 版本之前，@quasar/app-vite 的 SSR（服务端渲染）和 SSG（静态站点生成）渲染路径中，存在将 ssrContext.nonce 直接插入到带引号的 HTML 属性中的问题。如果应用通过攻击者可控的数据来派生或覆盖该值，则可能导致引号结束 nonce 属性，并能在开发和生产环境的 SSR 或 SSG 输出中注入额外的属性或标记。不过，通过密码学方式生成的、基于 base64 或 base64url 的 nonce

CVSS 8.3 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
@quasar app-vite < 3.3.0 affected
quasarframework quasar < 2.23.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106107

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Source: CVE Program / CVE List V5
Vulnerability Description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
quasarframework quasar < 2.23.4 -
@quasar app-vite < 3.3.0 -

II. Public POCs for CVE-2026-106107

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106107

请登录查看更多情报信息。

Other References for CVE-2026-106107 (3)

Same Patch Batch · quasarframework · 2026-10-06 · 8 CVEs total

CVE-2026-106102 10.0 CRITICAL Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
CVE-2026-106104 8.7 HIGH Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Q
CVE-2026-106105 8.4 HIGH Quasar Framework: Development TLS private keys are cached with overly permissive filesyste
CVE-2026-106103 7.1 HIGH Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
CVE-2026-106106 7.1 HIGH Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </sc
CVE-2026-106109 4.1 MEDIUM Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output d
CVE-2026-106101 3.1 LOW Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Caus

IV. Related Vulnerabilities

Same product: quasar
Same vendor: quasarframework
Same weakness: CWE-79

V. Comments for CVE-2026-106107

No comments yet

Leave a comment