GHSA-5m6h-8g35-p3m7: XSS

Q: Which applications are realistically exposed?

Applications using @quasar/app-vite SSR or SSG are exposed only if they derive or override ssrContext.nonce with attacker-controlled or otherwise unsafe data. Applications that use cryptographically generated base64 or base64url nonces are not directly affected.

Q: What must an attacker control to exploit this issue?

An attacker must be able to influence the value assigned to ssrContext.nonce. The supplied value must contain characters that can terminate the quoted nonce HTML attribute and introduce additional attributes or markup.

Q: How can I determine whether my application is affected?

Review all code that sets, derives, or overrides ssrContext.nonce, including SSR and SSG paths. Treat the application as affected if that value can originate from request data, user-controlled content, or another untrusted source rather than a non-empty cryptographically generated base64 or base64url nonce.

Q: What can be done if the remediation cannot be applied immediately?

Do not populate ssrContext.nonce from untrusted input. Restrict it to non-empty base64 or base64url nonce values generated cryptographically, since those values do not contain HTML attribute delimiters.

Published Oct 7, 2026

Updated

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML.

Cryptographically generated base64 or base64url nonces are not directly affected because they do not contain HTML attribute delimiters. Exploitation requires an application to place attacker-controlled or otherwise unsafe data in ssrContext.nonce.

The remediation centralizes nonce handling across development SSR/SSG, production SSR, production SSG, critical CSS, store-state scripts, and Vue Devtools. It validates the value as a non-empty base64/base64url CSP nonce and HTML-encodes the attribute value before rendering.

Affected Software

1 affected componentFixes available

npm/@quasar/app-vite<=3.2.0

3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/@quasar/app-vite to a version that resolves this vulnerability.
Fixed in 3.3.0
Compensating control
Centralize nonce handling across development SSR/SSG, production SSR, production SSG, critical CSS, store-state scripts, and Vue Devtools: require ssrContext.nonce to be a non-empty base64/base64url CSP nonce and HTML-encode it before rendering into quoted HTML attributes.

Event History

Oct 7, 2026

Advisory Published

via GitHub·04:16 PM

Data Sourced

via GitHub·04:16 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which applications are realistically exposed?

Applications using @quasar/app-vite SSR or SSG are exposed only if they derive or override ssrContext.nonce with attacker-controlled or otherwise unsafe data. Applications that use cryptographically generated base64 or base64url nonces are not directly affected.

What must an attacker control to exploit this issue?

An attacker must be able to influence the value assigned to ssrContext.nonce. The supplied value must contain characters that can terminate the quoted nonce HTML attribute and introduce additional attributes or markup.

How can I determine whether my application is affected?

Review all code that sets, derives, or overrides ssrContext.nonce, including SSR and SSG paths. Treat the application as affected if that value can originate from request data, user-controlled content, or another untrusted source rather than a non-empty cryptographically generated base64 or base64url nonce.

What can be done if the remediation cannot be applied immediately?

Do not populate ssrContext.nonce from untrusted input. Restrict it to non-empty base64 or base64url nonce values generated cryptographically, since those values do not contain HTML attribute delimiters.

GHSA-5m6h-8g35-p3m7: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed?

What must an attacker control to exploit this issue?

How can I determine whether my application is affected?

What can be done if the remediation cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed?

What must an attacker control to exploit this issue?

How can I determine whether my application is affected?

What can be done if the remediation cannot be applied immediately?