CVE-2026-106107: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in quasarframework quasar

The Quasar Framework, used for building Vue.js user interfaces, had a vulnerability in versions before 3.3.0 where several SSR and SSG rendering paths interpolated the ssrContext.nonce value directly into quoted HTML attributes without proper sanitization. If an application allows attacker-controlled input to influence this nonce value, it can lead to injection of additional attributes or markup, resulting in cross-site scripting (CWE-79). Cryptographically generated base64 or base64url nonces are not affected due to the absence of HTML attribute delimiters. The issue is resolved in Quasar Framework version 3.3.0.

An attacker who can influence or override the ssrContext.nonce value in affected Quasar Framework versions can inject arbitrary HTML or attributes into server-rendered pages, leading to cross-site scripting attacks. This can compromise the integrity of the web page and potentially lead to client-side code execution. The vulnerability affects both development and production SSR or SSG outputs. However, cryptographically generated nonces using base64 or base64url are not vulnerable.

Upgrade Quasar Framework to version 3.3.0 or later, where this vulnerability is fixed. Applications should ensure that the ssrContext.nonce value is not derived from or overridden by attacker-controlled input. No other mitigations are indicated by the vendor advisory.