CVE-2026-106102: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quasar Frameworkto a version that resolves this vulnerability.Fixed in 2.22.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only server-side rendered Quasar deployments that use the SSR getHead() metadata serializer are affected. The client-side apply() path is not affected because it uses DOM APIs that encode attributes.
What must an attacker control to exploit this issue?
An attacker must be able to influence metadata passed through useMeta(), such as a post title, product name, excerpt, or display name. They can use that control to break out of the intended HTML text or quoted-attribute context and inject executable markup into the server-rendered response.
What version fixes the issue?
Upgrade Quasar Framework to version 2.22.0 or later. Versions prior to 2.22.0 are affected.
What can be done if an immediate upgrade is not possible?
Prevent untrusted or attacker-influenced values from being used in useMeta() fields rendered by SSR, or ensure those values are correctly encoded for their HTML text or quoted-attribute context before they reach the metadata serializer.