CVE-2026-106106
- Source
- https://cve.org/CVERecord?id=CVE-2026-106106
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106106.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-106106
- Aliases
- Published
- 2026-10-06T17:24:07Z
- Modified
- 2026-10-07T10:47:14Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N CVSS Calculator
- Summary
- Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
- Details
-
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-497", "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106106.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106106.json
- https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15
- https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
- https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f
- https://nvd.nist.gov/vuln/detail/CVE-2026-106106
Affected packages
Git / github.com/quasarframework/quasar
Affected ranges
- Type
- GIT
- Repo
- https://github.com/quasarframework/quasar
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "2.23.3" }, { "fixed": "2.2.4" }, { "fixed": "3.3.0" } ], "source": "AFFECTED_FIELD" }
Affected versions
@quasar/app-v1.*
@quasar/app-v1.0.0-beta.10
@quasar/app-v1.0.0-beta.11
@quasar/app-v1.0.0-beta.12
@quasar/app-v1.0.0-beta.13
@quasar/app-v1.0.0-beta.14
@quasar/app-v1.0.0-beta.15
@quasar/app-v1.0.0-beta.16
@quasar/app-v1.0.0-beta.17
@quasar/app-v1.0.0-beta.18
@quasar/app-v1.0.0-beta.19
@quasar/app-v1.0.0-beta.20
@quasar/app-v1.0.0-beta.21
@quasar/app-v1.0.0-beta.22
@quasar/app-v1.0.0-beta.23
@quasar/app-v1.0.0-beta.24
@quasar/app-v1.0.0-beta.25
@quasar/app-v1.0.0-beta.26
@quasar/app-v1.0.0-beta.8
@quasar/app-v1.0.0-beta.9
@quasar/app-v1.0.0-rc.1
@quasar/app-v1.0.0-rc.2
@quasar/app-v1.0.0-rc.3
@quasar/app-v1.0.0-rc.4
@quasar/app-v1.0.0-rc.5
@quasar/app-v1.0.0-rc.6
@quasar/app-v1.0.0-rc.7
@quasar/app-v1.0.1
@quasar/app-v1.0.2
@quasar/app-v1.0.3
@quasar/app-v1.0.4
@quasar/app-v1.0.5
@quasar/app-v1.0.6
@quasar/app-v1.1.0
@quasar/app-v1.1.1
@quasar/app-v1.1.2
@quasar/app-v1.1.3
@quasar/app-v1.1.4
@quasar/app-v1.2.0
@quasar/app-v1.2.1
@quasar/app-v1.2.2
@quasar/app-v1.2.3
@quasar/app-v1.2.4
@quasar/app-v1.3.0
@quasar/app-v1.3.1
@quasar/app-v1.3.2
@quasar/app-v1.3.3
@quasar/app-v1.3.4
@quasar/app-v1.3.5
@quasar/app-v1.3.6
@quasar/app-v1.3.7
@quasar/app-v1.4.0
@quasar/app-v1.4.1
@quasar/app-v1.4.2
@quasar/app-v1.4.3
@quasar/app-v1.4.4
@quasar/app-v1.4.5
@quasar/app-v1.5.0
@quasar/app-v1.5.1
@quasar/app-v1.5.2
@quasar/app-v1.5.3
@quasar/app-v1.5.4
@quasar/app-v1.5.5
@quasar/app-v1.5.6
@quasar/app-v1.5.7
@quasar/app-v1.5.8
@quasar/app-v1.6.0
@quasar/app-v1.6.1
@quasar/app-v1.6.2
@quasar/app-v1.7.0
@quasar/app-v1.7.1
@quasar/app-v1.7.2
@quasar/app-v1.7.3
@quasar/app-v1.7.4
@quasar/app-v1.8.2
@quasar/app-v1.8.4
@quasar/app-v1.8.5
@quasar/app-v1.8.6
@quasar/app-v1.8.7
@quasar/app-v1.8.8
@quasar/app-v1.8.9
@quasar/app-v1.9.1
@quasar/app-v1.9.2
@quasar/app-v1.9.4
@quasar/app-v1.9.5
@quasar/app-v1.9.6
@quasar/app-v2.*
@quasar/app-v2.0.0
@quasar/app-v2.0.1
@quasar/app-v2.0.2
@quasar/app-v2.0.3
@quasar/app-v2.0.4
@quasar/app-v2.0.5
@quasar/app-v2.0.6
@quasar/app-v2.1.1
@quasar/app-v2.1.13
@quasar/app-v2.1.14
@quasar/app-v2.1.15
@quasar/app-v2.1.2
@quasar/app-v2.1.3
@quasar/app-v2.1.5
@quasar/app-v2.1.7
@quasar/app-v2.1.8
@quasar/app-v2.2.0
@quasar/app-v2.2.1
@quasar/app-v2.2.10
@quasar/app-v2.2.2
@quasar/app-v2.2.4
@quasar/app-v2.2.5
@quasar/app-v2.2.6
@quasar/app-v2.2.8
@quasar/app-v3.*
@quasar/app-v3.0.0
@quasar/app-v3.0.1
@quasar/app-v3.0.2
@quasar/app-v3.0.3
@quasar/app-v3.0.4
@quasar/app-v3.1.0
@quasar/app-v3.1.1
@quasar/app-v3.1.10
@quasar/app-v3.1.2
@quasar/app-v3.1.3
@quasar/app-v3.1.4
@quasar/app-v3.1.5
@quasar/app-v3.1.6
@quasar/app-v3.1.7
@quasar/app-v3.1.8
@quasar/app-v3.1.9
@quasar/babel-preset-app-v1.*
@quasar/babel-preset-app-v1.0.1
@quasar/cli-v1.*
@quasar/cli-v1.0.0-beta.3
@quasar/cli-v1.0.0-beta.4
@quasar/cli-v1.0.0-beta.5
@quasar/cli-v1.0.0-beta.6
@quasar/cli-v1.0.0-beta.7
@quasar/cli-v1.0.0-rc.1
@quasar/cli-v1.0.0-rc.2
@quasar/cli-v1.0.1
@quasar/cli-v1.0.2
@quasar/cli-v1.0.3
@quasar/cli-v1.0.4
@quasar/cli-v1.0.5
@quasar/cli-v1.0.6
@quasar/cli-v1.0.7
@quasar/cli-v1.1.0
@quasar/cli-v1.1.1
@quasar/cli-v1.1.2
@quasar/cli-v1.2.2
@quasar/extras-v1.*
@quasar/extras-v1.1.1
@quasar/extras-v1.1.2
@quasar/extras-v1.1.3
@quasar/extras-v1.1.4
@quasar/extras-v1.10.0
@quasar/extras-v1.10.1
@quasar/extras-v1.10.10
@quasar/extras-v1.10.11
@quasar/extras-v1.10.12
@quasar/extras-v1.10.2
@quasar/extras-v1.10.3
@quasar/extras-v1.10.4
@quasar/extras-v1.10.5
@quasar/extras-v1.10.6
@quasar/extras-v1.10.7
@quasar/extras-v1.10.8
@quasar/extras-v1.11.0
@quasar/extras-v1.11.1
@quasar/extras-v1.11.2
@quasar/extras-v1.2.0
@quasar/extras-v1.3.0
@quasar/extras-v1.3.2
@quasar/extras-v1.3.3
@quasar/extras-v1.4.0
@quasar/extras-v1.4.1
@quasar/extras-v1.4.2
@quasar/extras-v1.5.0
@quasar/extras-v1.5.1
@quasar/extras-v1.5.2
@quasar/extras-v1.6.0
@quasar/extras-v1.6.1
@quasar/extras-v1.6.2
@quasar/extras-v1.6.3
@quasar/extras-v1.7.0
@quasar/extras-v1.8.0
@quasar/extras-v1.8.1
@quasar/extras-v1.8.2
@quasar/extras-v1.9.0
@quasar/extras-v1.9.1
@quasar/extras-v1.9.10
@quasar/extras-v1.9.11
@quasar/extras-v1.9.11=2
@quasar/extras-v1.9.13
@quasar/extras-v1.9.14
@quasar/extras-v1.9.15
@quasar/extras-v1.9.16
@quasar/extras-v1.9.17
@quasar/extras-v1.9.18
@quasar/extras-v1.9.20
@quasar/extras-v1.9.4
@quasar/extras-v1.9.5
@quasar/extras-v1.9.6
@quasar/extras-v1.9.7
@quasar/extras-v1.9.8
@quasar/extras-v1.9.9
@quasar/icongenie-v2.*
@quasar/icongenie-v2.0.0
@quasar/icongenie-v2.0.1
@quasar/icongenie-v2.2.0
@quasar/icongenie-v2.3.0
@quasar/icongenie-v2.3.1
@quasar/icongenie-v2.4.1
@quasar/vite-plugin-v1.*
@quasar/vite-plugin-v1.0.0
@quasar/vite-plugin-v1.0.1
@quasar/vite-plugin-v1.0.2
extras-v1.*
extras-v1.1.0
quasar-1.*
quasar-1.14.2
quasar-1.15.16
Other
quasar-v
quasar-v1.*
quasar-v1.0.0-beta.1
quasar-v1.0.0-beta.10
quasar-v1.0.0-beta.11
quasar-v1.0.0-beta.12
quasar-v1.0.0-beta.13
quasar-v1.0.0-beta.14
quasar-v1.0.0-beta.15
quasar-v1.0.0-beta.16
quasar-v1.0.0-beta.17
quasar-v1.0.0-beta.18
quasar-v1.0.0-beta.19
quasar-v1.0.0-beta.20
quasar-v1.0.0-beta.21
quasar-v1.0.0-beta.22
quasar-v1.0.0-beta.23
quasar-v1.0.0-beta.24
quasar-v1.0.0-beta.7
quasar-v1.0.0-beta.8
quasar-v1.0.0-beta.9
quasar-v1.0.0-rc.2
quasar-v1.0.0-rc.3
quasar-v1.0.0-rc.4
quasar-v1.0.0-rc.5
quasar-v1.0.3
quasar-v1.0.4
quasar-v1.0.5
quasar-v1.1.0
quasar-v1.1.1
quasar-v1.1.2
quasar-v1.1.3
quasar-v1.1.4
quasar-v1.1.5
quasar-v1.1.6
quasar-v1.1.7
quasar-v1.10.1
quasar-v1.10.2
quasar-v1.10.3
quasar-v1.10.4
quasar-v1.10.5
quasar-v1.11.0
quasar-v1.11.1
quasar-v1.11.2
quasar-v1.11.3
quasar-v1.12.1
quasar-v1.12.10
quasar-v1.12.11
quasar-v1.12.12
quasar-v1.12.13
quasar-v1.12.3
quasar-v1.12.4
quasar-v1.12.5
quasar-v1.12.6
quasar-v1.12.7
quasar-v1.12.8
quasar-v1.12.9
quasar-v1.14.1
quasar-v1.14.4
quasar-v1.14.5
quasar-v1.15.0
quasar-v1.15.1
quasar-v1.15.10
quasar-v1.15.11
quasar-v1.15.12
quasar-v1.15.13
quasar-v1.15.14
quasar-v1.15.15
quasar-v1.15.19
quasar-v1.15.21
quasar-v1.15.4
quasar-v1.15.5
quasar-v1.15.6
quasar-v1.15.9
quasar-v1.2.0
quasar-v1.2.1
quasar-v1.2.2
quasar-v1.2.3
quasar-v1.2.4
quasar-v1.2.5
quasar-v1.2.6
quasar-v1.2.7
quasar-v1.3.0
quasar-v1.4.0
quasar-v1.4.1
quasar-v1.4.2
quasar-v1.4.4
quasar-v1.4.5
quasar-v1.5.0
quasar-v1.5.1
quasar-v1.5.10
quasar-v1.5.11
quasar-v1.5.2
quasar-v1.5.3
quasar-v1.5.4
quasar-v1.5.5
quasar-v1.5.6
quasar-v1.5.7
quasar-v1.5.8
quasar-v1.5.9
quasar-v1.6.0
quasar-v1.6.1
quasar-v1.7.0
quasar-v1.7.1
quasar-v1.7.2
quasar-v1.7.3
quasar-v1.7.4
quasar-v1.8.0
quasar-v1.8.1
quasar-v1.8.2
quasar-v1.8.3
quasar-v1.8.4
quasar-v1.8.5
quasar-v1.9.0
quasar-v1.9.1
quasar-v1.9.10
quasar-v1.9.11
quasar-v1.9.12
quasar-v1.9.13
quasar-v1.9.14
quasar-v1.9.15
quasar-v1.9.16
quasar-v1.9.2
quasar-v1.9.3
quasar-v1.9.4
quasar-v1.9.5
quasar-v1.9.6
quasar-v1.9.7
quasar-v1.9.8
quasar-v1.9.9
quasar-v2.*
quasar-v2.0.0
quasar-v2.0.1
quasar-v2.0.2
quasar-v2.0.3
quasar-v2.0.4
quasar-v2.1.0
quasar-v2.1.1
quasar-v2.1.2
quasar-v2.1.3
quasar-v2.1.4
quasar-v2.1.5
quasar-v2.1.6
quasar-v2.1.7
quasar-v2.1.8
quasar-v2.1.9
quasar-v2.2.0
quasar-v2.2.1
quasar-v2.2.2
quasar-v2.2.3
v0.*
v0.10
v0.10.1
v0.10.2
v0.10.3
v0.11
v0.12.0
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.14.1
v0.14.2
v0.14.5
v0.15.0
v0.15.1
v0.15.10
v0.15.11
v0.15.12
v0.15.13
v0.15.15
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.15.6
v0.15.7
v0.15.8
v0.15.9
v0.16.0
v0.17.0
v0.17.1
v0.17.10
v0.17.11
v0.17.12
v0.17.13
v0.17.14
v0.17.15
v0.17.16
v0.17.17
v0.17.18
v0.17.19
v0.17.2
v0.17.3
v0.17.4
v0.17.5
v0.17.6
v0.17.7
v0.17.8
v0.17.9
v0.4.1
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.1
v1.*
v1.0.0
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.15.8