Skip to content
OpenAdvisories

Package · npm

quasar

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.7
    CVE-2026-106104

    Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions …

    quasarframework quasar quasar npm
  • Critical 10.0
    CVE-2026-106102

    Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and…

    quasarframework quasar quasar npm
  • Low 3.1
    CVE-2026-106101

    Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-…

    quasarframework quasar quasar npm
  • Medium 5.6
    CVE-2026-73647

    Quasar Framework: Prototype pollution in Quasar extend() utility

    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep mer…

    quasarframework quasar quasar npm