CVE Intelligence
Analysis AI-assisted

CVE-2026-106102: Quasar Framework: Cross-site Scripting via unencoded SSR meta tag rendering in getHead()

Quasar Framework versions before 2.22.0 interpolate page metadata into server-rendered HTML without proper encoding, which can allow cross-site scripting when an attacker can influence those metadata values. The record rates the issue critical with a CVSS base score of 10 and states it is fixed in 2.22.0. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Quasar Framework's server-side rendering path builds page metadata tags for title, meta, link and script elements. According to the GitHub Security Advisory, the SSR-only serializer getHead() interpolated values without HTML text or quoted-attribute encoding, and that output was appended to the server response.

Impact

  • The record classifies the issue as cross-site scripting (CWE-79) with a CVSS base score of 10 (critical), network attack vector, no privileges and no user interaction required, and high confidentiality and integrity impact.
  • Exploitation depends on an attacker being able to influence dynamic metadata such as a post title, product name, excerpt or display name.
  • The client-side apply() path is described as not affected.

Affected products and versions

  • Product: Quasarframework Quasar.
  • Affected range: before 2.22.0.
  • Fixed version according to the advisory description: 2.22.0. The structured fixes field in the record is empty, so confirm against the release tag.

Exploitation status

The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. SSVC exploitation is recorded as none.

Remediation and mitigation

  • Upgrade Quasar to version 2.22.0 or later.
  • Until the upgrade is applied, review SSR pages where user-controlled data reaches page metadata and confirm that output is encoded.
  • Treat metadata derived from user content as untrusted in templates and server rendering.

Detection guidance

  • Review server-rendered HTML for unexpected markup inside title, meta, link or script elements.
  • Review application logs and content workflows for unusual values in fields that feed page metadata.

Limitations of the available information

The record does not list affected sub-ranges beyond the stated range or structured fix data. Whether a specific application is exploitable depends on how it populates metadata, which the record does not describe.

Frequently asked questions

Which Quasar versions are affected by CVE-2026-106102?

According to the record, versions before 2.22.0 are affected. The description states the issue is fixed in 2.22.0.

Does this issue affect client-side rendering?

The advisory description states that the client-side apply() path is not affected, because it uses DOM APIs that encode attributes. The issue is in the SSR-only serialization path.

Is this CVE known to be exploited in the wild?

The record shows it is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted. SSVC exploitation is recorded as none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.