CVE-2026-106107 in Quasar Framework
Summary
by MITRE • 10/06/2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Quasar Framework, a popular tool for developing high-performance Vue.js user interfaces, contained a significant server-side rendering vulnerability in versions prior to 3.3.0. The core of the issue lies in how the framework handles security nonces within its Server-Side Rendering and Static Site Generation pipelines. Specifically, several rendering paths directly interpolated the ssrContext.nonce value into HTML attributes without adequate sanitization or encoding mechanisms. This architectural flaw creates a pathway for attackers to manipulate the generated HTML structure if they can influence the content of the nonce variable.
The technical nature of this vulnerability is classified as an injection flaw, specifically falling under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting and CWE-611: XML External Entity Injection depending on the specific context of the rendered output. The vulnerability arises because the framework places the nonce value directly inside quoted HTML attributes. If an application developer derives or overrides this nonce with data that is not strictly controlled, such as user input or external API responses, a malicious actor can inject quote characters into that data. These injected quotes serve to terminate the intended attribute context prematurely.
Once the attribute boundary is broken through quote injection, the attacker gains the ability to insert additional HTML attributes or arbitrary markup elements directly into the generated page source. This capability effectively bypasses the security intent of using nonces for Content Security Policy enforcement and allows for Cross-Site Scripting attacks if malicious scripts are injected alongside the structural changes. The impact is severe because it compromises both the integrity of the DOM structure and potentially leads to code execution in the victim's browser, depending on what additional markup or attributes are introduced by the attacker.
It is important to note that this vulnerability is contingent upon the application deriving or overriding the ssrContext.nonce with untrusted data. Cryptographically generated base64 or base64url nonces remain unaffected because these encoding schemes do not include characters such as double quotes, single quotes, or other HTML attribute delimiters. Therefore, applications relying on standard cryptographic nonce generation practices are generally safe from this specific exploitation vector, provided they do not manually override the nonce with potentially tainted strings.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Injection and Web Application Attack vectors where attackers manipulate server-side rendering processes to inject malicious content into trusted web applications. The operational impact includes potential data theft, session hijacking, or defacement of the application interface if an attacker successfully exploits the injection capability in a production environment.
To mitigate this risk, organizations using Quasar Framework must upgrade immediately to version 3.3.0 or later, where the interpolation logic has been corrected to prevent attribute termination and subsequent markup injection. For applications that cannot yet upgrade, developers should implement strict input validation on any data used to set the ssrContext.nonce value. Ensuring that only cryptographically secure random strings are assigned to this context variable will effectively neutralize the attack surface by eliminating the possibility of quote-based delimiter breaking. Regular security audits and static analysis tools can also help identify instances where nonces or similar security tokens are derived from untrusted sources within Vue.js SSR applications.