{"id":"EUVD-2026-93571","enisaUuid":"af83c26c-de4a-3ae7-8cc8-a12763bf0cd4","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer\u0027s request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.","datePublished":"Oct 6, 2026, 5:24:07 PM","dateUpdated":"Oct 6, 2026, 6:22:44 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f\nhttps://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\n","aliases":"CVE-2026-106106\nGHSA-r5mf-4r5x-q78f\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"1c6817e1-421c-38c9-86c5-a81289427b97","product":{"name":"app-vite","vendor":{"name":"@quasar"}},"product_version":"\u003c 3.3.0"},{"id":"4a4954e9-a4b6-3ada-b661-c7384f5140df","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"\u003c 2.23.3"},{"id":"962f8c2b-9923-3509-9578-7f9aa22f39d0","product":{"name":"render-ssr-error","vendor":{"name":"@quasar"}},"product_version":"\u003c 2.2.4"}],"enisaIdVendor":[{"id":"78b04da9-8edd-3076-ad3d-e8d7fc7dc1b0","vendor":{"name":"@quasar"}},{"id":"7f29faca-2e09-3b57-a7e8-73bff6c33f29","vendor":{"name":"quasarframework"}}],"enisaIdVulnerability":[{"id":"20b2bf40-67d5-3d33-9529-0924badb89c0","vulnerability":{"id":"GHSA-r5mf-4r5x-q78f","description":"Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable","datePublished":"Oct 7, 2026, 4:16:12 PM","dateUpdated":"Oct 7, 2026, 4:16:12 PM","baseScore":0.0,"references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106106\nhttps://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15\nhttps://github.com/quasarframework/quasar\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\n","enisa_id":"EUVD-2026-93571\n","aliases":"CVE-2026-106106\nGHSA-r5mf-4r5x-q78f\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c770294d-81c2-33ff-a21d-7fe0a0e527a2","vulnerability":{"id":"CVE-2026-106106","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer\u0027s request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.","datePublished":"Oct 6, 2026, 5:24:07 PM","dateUpdated":"Oct 6, 2026, 6:22:44 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f\nhttps://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\n","enisa_id":"EUVD-2026-93571\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 1, 2026, 4:04:34 AM","vulnerabilityProduct":[{"id":"206262f0-fbdc-325b-a491-ca0db4c361c7","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"\u003c 2.23.3"},{"id":"5231af58-424b-3ed6-b45e-9cfae3905f8b","product":{"name":"render-ssr-error","vendor":{"name":"@quasar"}},"product_version":"\u003c 2.2.4"},{"id":"61353557-e6dc-3522-a5e7-121e1ca71f17","product":{"name":"app-vite","vendor":{"name":"@quasar"}},"product_version":"\u003c 3.3.0"}],"vulnerabilityVendor":[{"id":"672f3354-317a-3ce9-afc2-6de345114d4f","vendor":{"name":"quasarframework"}},{"id":"921ab90d-0288-3f61-ae5e-957f39bbe825","vendor":{"name":"@quasar"}}]}}],"enisaIdAdvisory":[]}