CVE-2026-106101 Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Attackers can cause client-side denial of service in Quasar Framework by clobbering the SafariViewController object via DOM manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-106101?
CVE-2026-106101 is a low-severity vulnerability in quasarframework quasar, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.
Weakness: CWE-843
Which versions are affected by CVE-2026-106101?
2 open source packages ship an affected version, including quasar.
| Package | Affected | Fixed in |
|---|---|---|
quasar npm | All versions | 2.32.2 |
quasar npm | All versions | 2.32.2 |
How do I fix CVE-2026-106101?
Upgrade quasar to 2.32.2 or later.
Is CVE-2026-106101 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106101 exists.
Sources
Also known as GHSA-89vp-x45c-52cq.