CVE-2026-106102: Quasar Framework Stored/Reflected XSS via Unescaped SSR Meta Tag Rendering
Summary
CVE-2026-106102: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead(). Affects quasar versions < 2.22.0. Fixed in 2.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Quasar Framework is a popular open-source framework for building responsive web applications using Vue.js. It provides a rich set of features including server-side rendering (SSR), which allows developers to create dynamic web pages that can be rendered on the server before being sent to the client. However, a critical vulnerability has been identified in its SSR meta tag rendering functionality, which can lead to severe security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the getHead() function in the Quasar Framework's SSR implementation, which serializes meta, link, script, and title data without proper HTML entity escaping. This oversight allows an attacker to inject arbitrary HTML or JavaScript into the response sent to users. For instance, if an attacker can influence the content passed to the useMeta() function, they can execute malicious scripts in the context of the victim's browser, leading to session hijacking, credential theft, or defacement of the site. The vulnerability is classified as a Cross-Site Scripting (XSS) issue, specifically CWE-79, with a CVSS score of 10.0, indicating its critical severity.
How To Fix
Latest published version: 2.35.2 as of 23 Oct 2026
npm install quasar@2.35.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.22.0
This is the first release that contains the fix.
npm install quasar@2.22.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, you can implement a temporary workaround by manually escaping any user-generated content passed to the useMeta() function. For example:
function escapeHtml(val) {
return String(val)
.replaceAll('&', '&')
.replaceAll('<', '<')
.replaceAll('>', '>')
.replaceAll('"', '"');
}
Use this function to sanitize inputs before passing them to useMeta().
Conclusion
The CVE-2026-106102 vulnerability in the Quasar Framework poses a significant risk due to its potential for XSS attacks. It is crucial for developers using this framework to update to the patched version and implement proper input sanitization to protect their applications from exploitation.
See every vulnerability recorded for quasar →
FAQ
Quasar Framework is an open-source framework for building responsive web applications using Vue.js, offering features like server-side rendering and a rich set of UI components.
CVE-2026-106102 is a critical vulnerability in the Quasar Framework that allows for stored and reflected XSS attacks due to unescaped meta tag rendering in server-side responses.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you in real-time about vulnerabilities. You can also check your application using the Vulert playground without signup.
The vulnerability can lead to full client-side script execution, allowing attackers to steal cookies, perform credential phishing, or take over user accounts.
To implement the fix, update your Quasar Framework to version 2.22.0 or later using the command npm install quasar@2.22.0, and ensure that all user inputs are properly escaped before rendering.
References
Related vulnerabilities
Recent vulnerabilities recorded for quasar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
