@quasar/app-vite: HTML attribute injection via SSR/SSG nonce
Summary
The @quasar/app-vite build tool inserted the SSR/SSG nonce value into quoted HTML attributes without safe constraints. If an application derives or overrides the nonce with attacker-controlled data, an attacker can end the attribute early and inject additional attributes or markup into server-rendered pages. Cryptographically generated base64 or base64url nonces are not affected. Exposure is limited to custom nonce handling in publicly reachable SSR or SSG applications.
Affected
- @quasar/app-vite before 3.3.0
- quasarframework/quasar before 2.23.4 (listed in the CNA record; mapping not verified in the primary advisory)
Fixed in
- @quasar/app-vite 3.3.0 or later
Workaround
- No vendor workaround documented. Upgrading is the fix.
- Until patched, make sure nonces come from a server-side cryptographic random generator and are never built from request data or other user input (own assessment, not a vendor instruction).
Exploitation
- Not known to be exploited in the wild according to HOL; not verified in the CISA KEV catalogue.
- No public proof of concept found; this does not rule out that one exists.
- CISA SSVC: exploitation none, not automatable. EPSS 0.00266.
Our recommendation
- Check lockfiles and package manifests for @quasar/app-vite below 3.3.0.
- Upgrade @quasar/app-vite to 3.3.0 or later; this also covers the related Quasar CVEs CVE-2026-106105 and CVE-2026-106106.
- Review any custom ssrContext.nonce handling in SSR and SSG code and ensure it is not derived from user input.
- Prioritise publicly reachable SSR or SSG applications that use custom nonces.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Quasar commit 91271c3 (fix) github.com
- Quasar @quasar/app-vite v3.3.0 release github.com
- GitHub Security Advisory GHSA-5m6h-8g35-p3m7 github.com
- Tenable CVE record CVE-2026-106107 www.tenable.com
- OSV CVE-2026-106107 osv.dev
- OpenCVE CVE-2026-106107 app.opencve.io
- HOL advisory CVE-2026-106107 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:14.
Original description (NVD)
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.