CVE-2026-106102: Quasar Framework: Cross-site scripting via unescaped SSR meta tag rendering

Summary

Quasar Framework is a Vue.js framework. In versions before 2.22.0, the server-side rendering meta serializer inserted values from useMeta() into title, meta, link and script markup without proper HTML encoding. An attacker who can influence page metadata such as a post title, product name or display name can inject executable markup into the server response, which runs in the browser of visitors before hydration. The client-side path is not affected.

Affected

Quasar Framework versions before 2.22.0 that use SSR with useMeta() and server-side meta injection (injectServerMeta)
Client-side only (SPA) deployments are not affected according to the advisory

Fixed in

Upgrade to Quasar 2.22.0 or later. The release notes list the fix as 'secure SSR meta serialization'.
Current releases in the 2.32.x line are available; confirm on the official releases page and test SSG projects after upgrading.

Workaround

Unknown. No vendor workaround is documented.
Until upgraded, ensure that metadata values never contain untrusted input, or escape them in your own SSR code.

Exploitation

No known exploitation in the wild. No CISA KEV entry found.
CISA SSVC: exploitation none, automatable yes, technical impact total.
The GHSA text mentions a proof of concept by the reporter; no public exploit was found.
EPSS 0.00299 (low predicted probability).

Our recommendation

Inventory all Quasar projects and check for versions below 2.22.0 in package.json and lockfiles.
Identify SSR projects that use useMeta() with user-influenced data.
Upgrade to 2.22.0 or later and run regression tests, especially for SSG projects.
Check public pages for signs of injected scripts.
Note: VulDB rates the issue 4.3 (Medium) while NVD/CNA rate it 10.0 (Critical); review the vector against your exposure.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

GitHub Security Advisory GHSA-pq96-jpmf-w254 github.com
Fix commit 11505afe5b5218f2c468f130181815b898fd1e40 github.com
Quasar release v2.22.0 github.com
OSV GHSA-pq96-jpmf-w254 osv.dev
OSV CVE-2026-106102 osv.dev
VulDB 414366 vuldb.com
Vulners CVELIST:CVE-2026-106102 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:35.

Original description (NVD)

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed