CVE-2026-106108 debrief: The Quasar Framework's App Vite SSG page output paths can escape the configured distribution directory due to improper handling of custom dir and filename values in page definitions. This issue allows attackers to create files outside the intended build output directory by influencing SSG page definitions, potentially leading to unauthorized file creation with build user permissio [truncated]
A DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge. The vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `<a id='SafariViewController'>` can cause the browser to expose that element [truncated]
The Quasar Framework is vulnerable to stored and reflected XSS attacks due to the lack of HTML-entity escaping and attribute-quote escaping in the `getHead()` function. This function is used to serialize meta/link/script/title data collected from the `useMeta()` composable into a literal HTML string, which is then interpolated into the raw HTTP response `<head>` by the production SSR template. The vulnera [truncated]
CVE-2026-106104: The Quasar Framework is vulnerable to super-linear regex backtracking on the User-Agent request header, which can cause a Quasar SSR server to stall. This issue is fixed in version 2.23.3. Defenders should assess exposure and prioritize upgrading to version 2.23.3 or later. The vulnerability allows an unauthenticated request to stall the server, potentially leading to denial-of-service (D [truncated]
The Quasar Framework, used for building high-performance Vue.js user interfaces, had a vulnerability in its public extend() utility prior to version 2.22.0. This utility could recursively copy attacker-controlled object keys during deep merges without properly handling the __proto__ property. This could lead to prototype pollution, allowing attackers to write properties to Object.prototype in the same Jav [truncated]
