[ Vendor · 9 CVEs ]
quasarframework
CVEs affecting quasarframework published in the last 30 days, plus any quasarframework CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106108 | 13 Oct 2026 | CVSS 5.7 | Quasar Framework: App Vite SSG page output paths can escape the configured distribution directoryQuasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions… | Fix |
| CVE-2026-106106 | 6 Oct 2026 | CVSS 7.1 | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassableQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite… | Fix |
| CVE-2026-106107 | 6 Oct 2026 | CVSS 8.3 | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering… | Fix |
| CVE-2026-106109 | 6 Oct 2026 | CVSS 4.1 | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directoriesQuasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed… | Fix |
| CVE-2026-106103 | 6 Oct 2026 | CVSS 7.1 | Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profileQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate… | Fix |
| CVE-2026-106104 | 6 Oct 2026 | CVSS 8.7 | Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR serverQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded… | Fix |
| CVE-2026-106105 | 6 Oct 2026 | CVSS 8.4 | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and… | Fix |
| CVE-2026-106101 | 6 Oct 2026 | CVSS 3.1 | Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of ServiceQuasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in… | Fix |
| CVE-2026-106102 | 6 Oct 2026 | CVSS 10.0 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in… | Fix |