npm/@quasar/app-vite CVE-2026-106106: high, EPSS 0.28%
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
Action: Upgrade @quasar/app-vite to 3.3.0 or later.
npm i @quasar/app-vite@3.3.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.3.0 | - |
Fixed versions
| 3.3.0 |
Sources
- osv: GHSA-r5mf-4r5x-q78f#npm/@quasar/app-vite
- https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f
- https://nvd.nist.gov/vuln/detail/CVE-2026-106106
- https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15
- https://github.com/quasarframework/quasar
- https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
CVE-2026-106106 · published · modified · JSON