CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Attackers can inject executable scripts via unescaped SSR meta tags in Quasar Framework, affecting server-rendered pages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106102?
CVE-2026-106102 is a critical cross-site scripting vulnerability in quasarframework quasar, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
Which versions are affected by CVE-2026-106102?
2 open source packages ship an affected version, including quasar.
| Package | Affected | Fixed in |
|---|---|---|
quasar npm | All versions | 2.22.0 |
quasar npm | All versions | 2.22.0 |
How do I fix CVE-2026-106102?
Upgrade quasar to 2.22.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-106102 being exploited?
There is no known exploitation of CVE-2026-106102 in the wild and no public exploit code.
Sources
Also known as GHSA-pq96-jpmf-w254.