CVE-2026-106102: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in quasarframework quasar

Quasar Framework versions prior to 2.22.0 contain an XSS vulnerability in the server-side rendering (SSR) getHead() serializer located in ui/src/plugins/meta/Meta.js. The serializer uses getAttr() to interpolate user-supplied metadata values (e.g., post titles, product names) into HTML title, meta, link, and script tags without applying HTML text or quoted-attribute encoding. The injectServerMeta() function appends this output directly to the raw server-rendered response, enabling an attacker who controls dynamic metadata to break out of the intended HTML context and inject executable markup before client-side hydration. The client-side apply() method is unaffected because it uses DOM APIs that properly encode attributes. This vulnerability is addressed by the fix introduced in version 2.22.0.

Successful exploitation allows an unauthenticated attacker who can influence dynamic page metadata to execute arbitrary JavaScript in the context of the affected web application, leading to full confidentiality and integrity compromise of user data (confidentiality and integrity impact rated high). Availability is not impacted. The vulnerability has a CVSS 3.1 base score of 10.0 (critical), indicating it is easy to exploit remotely without privileges or user interaction and results in complete compromise of confidentiality and integrity.

Upgrade to Quasar Framework version 2.22.0 or later, where this vulnerability is fixed. No other mitigations are indicated or required as the issue is resolved by proper encoding in the server-side rendering path. There is no indication that the vulnerability is mitigated by configuration or other means.