HTML Injection Vulnerability in Quasar Framework by Quasar

CVE-2026-106102

What is CVE-2026-106102?

The Quasar Framework, used for building Vue.js user interfaces, contains a vulnerability in the SSR-only getHead() serializer prior to version 2.22.0. This issue arises because it uses getAttr() for injecting page metadata without proper HTML text or quoted-attribute encoding. As a result, an attacker capable of influencing dynamic metadata—such as titles or product names—can disrupt the HTML context, enabling injection of executable markup before hydration. It’s important to note that the client-side apply() path remains unaffected, as it employs DOM APIs that ensure proper attribute encoding. The vulnerability has been addressed in version 2.22.0.

References