[ Vendor · 6 CVEs ]
@quasar
CVEs affecting @quasar published in the last 30 days, plus any @quasar CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106108 | 13 Oct 2026 | CVSS 5.7 | Quasar Framework: App Vite SSG page output paths can escape the configured distribution directoryQuasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions… | Fix |
| CVE-2026-106106 | 6 Oct 2026 | CVSS 7.1 | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassableQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite… | Fix |
| CVE-2026-106107 | 6 Oct 2026 | CVSS 8.3 | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering… | Fix |
| CVE-2026-106109 | 6 Oct 2026 | CVSS 4.1 | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directoriesQuasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed… | Fix |
| CVE-2026-106103 | 6 Oct 2026 | CVSS 7.1 | Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profileQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate… | Fix |
| CVE-2026-106105 | 6 Oct 2026 | CVSS 8.4 | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and… | Fix |