CVE-2026-106102 in Quasar
Summary
by MITRE • 10/06/2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Quasar Framework serves as a robust tool for developing high-performance user interfaces based on the Vue.js ecosystem, yet versions prior to 2.22.0 contained a critical server-side rendering vulnerability within its meta management plugin. The core of this issue resides in the getHead() serializer located at ui/src/plugins/meta/Meta.js, which is exclusively utilized during server-side rendering processes. This component is responsible for processing metadata provided via the useMeta() function and inserting it into HTML title, meta, link, and script tags within the generated page structure. The fundamental technical flaw lies in the method used to handle user-supplied data; specifically, the serializer relies on getAttr() without applying necessary HTML text encoding or quoted-attribute escaping mechanisms. This lack of sanitization means that any special characters present in dynamic metadata values are passed through directly into the raw HTTP response stream sent by injectServerMeta().
This architectural oversight creates a significant security risk for applications relying on Quasar for server-side rendering, particularly when those applications allow end-users or external inputs to influence page metadata. Common examples of such vulnerable data points include post titles, product names, user display names, or excerpt text that are dynamically rendered into the head section of an HTML document. Because the output is not encoded, an attacker who can control these input fields can inject arbitrary characters that break out of their intended context within the HTML structure. By inserting specific sequences such as closing tags followed by new script elements, an adversary can terminate the current tag and introduce executable JavaScript code directly into the page before it reaches the client browser for hydration.
The operational impact of this vulnerability is severe, constituting a Stored or Reflected Cross-Site Scripting attack depending on how the metadata is sourced and persisted. Since the injection occurs in the server-rendered HTML payload, the malicious script executes immediately upon loading by any user who views the affected page, bypassing client-side protections that might otherwise mitigate such attacks. The vulnerability specifically targets the SSR pipeline because the client-side apply() path utilizes standard DOM APIs which inherently perform attribute encoding and context-aware escaping, thereby neutralizing similar injection attempts in non-SSR contexts. This discrepancy highlights a common pitfall where server-generated HTML is treated with less rigor than client-manipulated content, leading to exploitable gaps in security posture for dynamic web applications.
To mitigate this risk, organizations using Quasar Framework must ensure they are operating on version 2.22.0 or later, which implements proper encoding strategies within the getHead() serializer. For environments where immediate upgrading is not feasible, developers should implement manual sanitization of all metadata inputs before passing them to useMeta(), ensuring that special characters like angle brackets and quotes are HTML-encoded. This vulnerability aligns with CWE-79, known as Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-site Scripting, specifically within the context of server-side rendering logic. From a tactical perspective, this flaw facilitates initial code execution on victim browsers without requiring user interaction beyond page visitation, mapping closely to MITRE ATT&CK techniques related to Client-Side Injection and potentially enabling further attacks such as session hijacking or credential theft if sensitive data is present in the compromised context.