{"action":"Upgrade @quasar/app-vite to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"0"}],"component":"@quasar/app-vite","cve_ids":["CVE-2026-106107"],"ecosystem":"npm","epss":0.00266,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-5m6h-8g35-p3m7","id":"tcs_01M5KF43WC4K9P0GV84NX7E6NH","modified_at":"2026-10-07T16:30:05.794508526Z","published_at":"2026-10-07T16:16:03Z","references":["https://osv.dev/vulnerability/GHSA-5m6h-8g35-p3m7","https://github.com/quasarframework/quasar/security/advisories/GHSA-5m6h-8g35-p3m7","https://nvd.nist.gov/vuln/detail/CVE-2026-106107","https://github.com/quasarframework/quasar/commit/91271c38859bec51e154b60c24497a637ce903d7","https://github.com/quasarframework/quasar","https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-5m6h-8g35-p3m7","url":"https://osv.dev/vulnerability/GHSA-5m6h-8g35-p3m7"},{"source":"nvd","source_id":"CVE-2026-106107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106107"}],"summary":"Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained"}