Answer in brief
CVE-2026-106106 records a High severity (CVSS 7.1) vulnerability in Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable. The current sources do not mark it as known exploited. The current feed maps @quasar/app-vite (generic), quasarframework/quasar (generic), @quasar/render-ssr-error (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @quasar/app-vite (generic), quasarframework/quasar (generic), @quasar/render-ssr-error (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @quasar/app-vitegeneric | <3.3.0 | 3.3.0 |
| quasarframework/quasargeneric | <2.23.3 | 2.23.3 |
| @quasar/render-ssr-errorgeneric | <2.2.4 | 2.2.4 |
Published upstream
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 6, 2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
Quoted source text, attributed separately from HOL analysis.