Quasar Framework up to 2.32.1 OpenURL Utility open-url.js openURL cross site scripting

Summaryinfo

A vulnerability was found in Quasar Framework Quasar up to 2.32.1. It has been rated as problematic. The affected element is the function openURL of the file ui/src/utils/open-url/open-url.js of the component OpenURL Utility. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-106101. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Quasar Framework Quasar up to 2.32.1 and classified as problematic. This issue affects the function openURL of the file ui/src/utils/open-url/open-url.js of the component OpenURL Utility. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-106101 since 10/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 2.32.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-93516). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Quasar Framework

Name

• Quasar

Version

• 2.32.0
• 2.32.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion