5vulnerabilities
- Critical0 (0.0%)
- High3 (60.0%)
- Medium0 (0.0%)
- Moderate2 (40.0%)
- Low0 (0.0%)
quasar-app-vite
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 3HighAffects 3 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- 5 vulnerabilities
- Critical: 0
- High: 3
- Medium: 0
- Moderate: 2
- Low: 0
Vulnerabilities (5)
Known vulnerabilities affecting quasar-app-vite, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-5m6h-8g35-p3m7 | High | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedSeveral @quasar/app-vite SSR and SSG renderer paths interpolate `ssrContext.nonce` directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML. Cryptographically generated base64 or base64url nonces are not directly affected because they do not contain HTML attribute delimiters. Exploitation requires an application to place attacker-controlled or otherwise unsafe data in `ssrContext.nonce`. The remediation centralizes nonce handli |
| GitHub (opens in a new tab) | |
| GHSA-fh39-c73x-5pjv | High | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsThe `@quasar/ssl-certificate` development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesystem access could copy and reuse the private key to impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also unnecessarily CA-capable and included broad key usages beyond its localhost HTTPS purpose. Its IPv6 loopback entry was encoded as |
| GitHub (opens in a new tab) | |
| GHSA-q9mq-245r-4g93 | Moderate | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories## Summary `@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project. ## Details The build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory |
| GitHub (opens in a new tab) | |
| GHSA-r5mf-4r5x-q78f | High | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable### Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `<script>` element behind a `replaceAll('</script>', ...)` guard that is ASCII-case-sensitive and requires a literal `>`, so `</SCRIPT>`, `</script >` and `</script |
| GitHub (opens in a new tab) | |
| GHSA-vhhq-m2gm-rwc9 | Moderate | Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory## Summary During an SSG build, page definitions returned by `getSsgPages()` can provide custom `dir` and `filename` values. The builder joined those values to `build.distDir` and wrote the generated page without verifying that the final destination remained inside the distribution directory. ## Details A page definition containing parent-directory traversal could cause the build to create a new HTML file outside `build.distDir`. An existing symlink below the distribution directory could also redirect a generated file or newly created directories outside the output tree. Quasar application |
| GitHub (opens in a new tab) |
- GHSA-5m6h-8g35-p3m7HighQuasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
< 3.3.0
Several @quasar/app-vite SSR and SSG renderer paths interpolate `ssrContext.nonce` directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML. Cryptographically generated base64 or base64url nonces are not directly affected because they do not contain HTML attribute delimiters. Exploitation requires an application to place attacker-controlled or otherwise unsafe data in `ssrContext.nonce`. The remediation centralizes nonce handli
CVE: CVE-2026-106107
- GHSA-fh39-c73x-5pjvHighQuasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
< 3.3.0
The `@quasar/ssl-certificate` development utility caches a combined PEM containing a generated private key and certificate without explicitly restricting its filesystem permissions. On systems with a typical process umask, the PEM can be readable by other local users. A local attacker with filesystem access could copy and reuse the private key to impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also unnecessarily CA-capable and included broad key usages beyond its localhost HTTPS purpose. Its IPv6 loopback entry was encoded as
CVE: CVE-2026-106105
- GHSA-q9mq-245r-4g93ModerateQuasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
>= 1.0.0, < 3.3.0
## Summary `@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project. ## Details The build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory
CVE: CVE-2026-106109
- GHSA-r5mf-4r5x-q78fHighQuasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
< 3.3.0
### Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `<script>` element behind a `replaceAll('</script>', ...)` guard that is ASCII-case-sensitive and requires a literal `>`, so `</SCRIPT>`, `</script >` and `</script
CVE: CVE-2026-106106
- GHSA-vhhq-m2gm-rwc9ModerateQuasar Framework: App Vite SSG page output paths can escape the configured distribution directory
>= 3.1.0, < 3.3.0
## Summary During an SSG build, page definitions returned by `getSsgPages()` can provide custom `dir` and `filename` values. The builder joined those values to `build.distDir` and wrote the generated page without verifying that the final destination remained inside the distribution directory. ## Details A page definition containing parent-directory traversal could cause the build to create a new HTML file outside `build.distDir`. An existing symlink below the distribution directory could also redirect a generated file or newly created directories outside the output tree. Quasar application
CVE: CVE-2026-106108