{"id":"CVE-2026-106106","summary":"Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable","details":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.","aliases":["GHSA-r5mf-4r5x-q78f"],"modified":"2026-10-07T10:47:14.898458889Z","published":"2026-10-06T17:24:07.788Z","database_specific":{"cwe_ids":["CWE-497","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106106.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106106.json"},{"type":"FIX","url":"https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15"},{"type":"WEB","url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"},{"type":"ADVISORY","url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106106"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/quasarframework/quasar","events":[{"introduced":"0"},{"fixed":"db082a4407936be7865c7c85dd1862bb213f0c08"},{"fixed":"ba5bd096d06a884878d6b3e8b3bc38ee3ef738f2"},{"fixed":"605f4da74c54bd3c3f3a22350396ca8c1ee0e084"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"2.23.3"},{"fixed":"2.2.4"},{"fixed":"3.3.0"}]}}],"versions":["@quasar/icongenie-v2.4.1","@quasar/app-v3.1.10","quasar-v2.2.3","@quasar/app-v3.1.9","@quasar/vite-plugin-v1.0.2","@quasar/app-v3.1.8","quasar-v2.2.2","@quasar/app-v3.1.7","@quasar/vite-plugin-v1.0.1","@quasar/vite-plugin-v1.0.0","quasar-v2.2.1","@quasar/app-v3.1.6","quasar-v2.2.0","@quasar/cli-v1.2.2","quasar-v2.1.9","quasar-v2.1.8","quasar-v2.1.7","quasar-v2.1.6","@quasar/app-v3.1.5","quasar-v2.1.5","@quasar/app-v3.1.4","quasar-v2.1.4","quasar-v2.1.3","quasar-v2.1.2","quasar-v2.1.1","@quasar/app-v3.1.3","@quasar/extras-v1.11.2","@quasar/app-v3.1.2","@quasar/app-v3.1.1","@quasar/extras-v1.11.1","quasar-v2.1.0","@quasar/extras-v1.11.0","@quasar/extras-v1.10.12","quasar-v2.0.4","@quasar/app-v3.1.0","@quasar/extras-v1.10.11","@quasar/extras-v1.10.10","@quasar/app-v3.0.4","quasar-v2.0.3","@quasar/app-v3.0.3","quasar-v2.0.2","@quasar/app-v3.0.2","@quasar/extras-v1.10.8","quasar-v2.0.1","@quasar/app-v3.0.1","quasar-v2.0.0","@quasar/app-v3.0.0","quasar-v1.15.21","@quasar/extras-v1.10.7","@quasar/app-v2.2.10","@quasar/extras-v1.10.6","quasar-v1.15.19","@quasar/app-v2.2.8","quasar-1.15.16","@quasar/extras-v1.10.5","quasar-v1.15.15","quasar-v1.15.14","quasar-v1.15.13","@quasar/app-v2.2.6","quasar-v1.15.12","quasar-v1.15.11","@quasar/app-v2.2.5","@quasar/extras-v1.10.4","@quasar/extras-v1.10.3","quasar-v1.15.10","@quasar/app-v2.2.4","@quasar/extras-v1.10.2","@quasar/extras-v1.10.1","quasar-v1.15.9","v1.15.8","@quasar/extras-v1.10.0","@quasar/extras-v1.9.20","quasar-v1.15.6","@quasar/app-v2.2.2","@quasar/app-v2.2.1","quasar-v1.15.5","@quasar/app-v2.2.0","@quasar/extras-v1.9.18","quasar-v1.15.4","@quasar/app-v2.1.15","@quasar/extras-v1.9.17","@quasar/extras-v1.9.16","@quasar/extras-v1.9.15","quasar-v1.15.1","@quasar/extras-v1.9.14","@quasar/extras-v1.9.13","quasar-v1.15.0","@quasar/app-v2.1.14","@quasar/app-v2.1.13","@quasar/extras-v1.9.11=2","@quasar/extras-v1.9.11","@quasar/app-v2.1.8","quasar-v1.14.5","quasar-v1.14.4","@quasar/app-v2.1.7","@quasar/extras-v1.9.10","@quasar/app-v2.1.5","@quasar/app-v2.1.3","quasar-1.14.2","@quasar/app-v2.1.2","@quasar/extras-v1.9.9","@quasar/extras-v1.9.8","quasar-v1.14.1","@quasar/app-v2.1.1","@quasar/cli-v1.1.2","@quasar/cli-v1.1.1","@quasar/extras-v1.9.7","@quasar/extras-v1.9.6","@quasar/extras-v1.9.5","@quasar/extras-v1.9.4","@quasar/extras-v1.9.1","quasar-v1.12.13","@quasar/extras-v1.9.0","@quasar/icongenie-v2.3.1","@quasar/app-v2.0.6","quasar-v1.12.12","@quasar/app-v2.0.5","quasar-v1.12.11","quasar-v1.12.10","@quasar/app-v2.0.4","quasar-v1.12.9","@quasar/app-v2.0.3","@quasar/app-v2.0.2","@quasar/app-v2.0.1","quasar-v1.12.8","@quasar/cli-v1.1.0","quasar-v1.12.7","quasar-v1.12.6","@quasar/app-v2.0.0","@quasar/icongenie-v2.3.0","quasar-v1.12.5","quasar-v1.12.4","@quasar/extras-v1.8.2","quasar-v1.12.3","@quasar/app-v1.9.6","@quasar/app-v1.9.5","@quasar/app-v1.9.4","quasar-v1.12.1","@quasar/app-v1.9.2","@quasar/app-v1.9.1","@quasar/app-v1.8.9","@quasar/app-v1.8.8","@quasar/app-v1.8.7","quasar-v1.11.3","quasar-v1.11.2","@quasar/extras-v1.8.1","quasar-v1.11.1","quasar-v1.11.0","@quasar/extras-v1.8.0","@quasar/app-v1.8.6","@quasar/app-v1.8.5","quasar-v1.10.5","@quasar/icongenie-v2.2.0","quasar-v1.10.4","quasar-v1.10.3","quasar-v1.10.2","quasar-v1.10.1","@quasar/app-v1.8.4","@quasar/app-v1.8.2","@quasar/extras-v1.7.0","@quasar/app-v1.7.4","@quasar/app-v1.7.3","@quasar/icongenie-v2.0.1","@quasar/icongenie-v2.0.0","quasar-v1.9.16","@quasar/app-v1.7.2","@quasar/cli-v1.0.7","quasar-v1.9.15","@quasar/app-v1.7.1","@quasar/app-v1.7.0","@quasar/cli-v1.0.6","@quasar/extras-v1.6.3","@quasar/app-v1.6.2","quasar-v1.9.14","@quasar/extras-v1.6.2","quasar-v1.9.13","@quasar/app-v1.6.1","@quasar/extras-v1.6.1","quasar-v1.9.12","quasar-v1.9.11","quasar-v1.9.10","quasar-v1.9.9","@quasar/extras-v1.6.0","quasar-v1.9.8","quasar-v1.9.7","quasar-v1.9.6","quasar-v1.9.5","@quasar/app-v1.6.0","quasar-v1.9.4","@quasar/extras-v1.5.2","quasar-v1.9.3","@quasar/app-v1.5.8","@quasar/app-v1.5.7","@quasar/app-v1.5.6","quasar-v1.9.2","quasar-v1.9.1","@quasar/app-v1.5.5","quasar-v1.9.0","@quasar/app-v1.5.4","@quasar/extras-v1.5.1","@quasar/app-v1.5.3","quasar-v1.8.5","quasar-v1.8.4","quasar-v1.8.3","quasar-v1.8.2","quasar-v1.8.1","quasar-v1.8.0","@quasar/extras-v1.5.0","@quasar/app-v1.5.2","quasar-v1.7.4","@quasar/extras-v1.4.2","quasar-v1.7.3","quasar-v1.7.2","@quasar/app-v1.5.1","@quasar/extras-v1.4.1","@quasar/app-v1.5.0","quasar-v1.7.1","quasar-v1.7.0","@quasar/app-v1.4.5","@quasar/extras-v1.4.0","@quasar/app-v1.4.4","quasar-v1.6.1","quasar-v1.6.0","quasar-v1.5.11","quasar-v1.5.10","@quasar/app-v1.4.3","@quasar/cli-v1.0.5","@quasar/cli-v1.0.4","@quasar/app-v1.4.2","@quasar/app-v1.4.1","quasar-v1.5.9","@quasar/app-v1.4.0","@quasar/app-v1.3.7","quasar-v1.5.8","@quasar/app-v1.3.6","@quasar/app-v1.3.5","quasar-v1.5.7","quasar-v1.5.6","@quasar/app-v1.3.4","quasar-v1.5.5","@quasar/app-v1.3.3","quasar-v1.5.4","@quasar/app-v1.3.2","quasar-v1.5.3","quasar-v1.5.2","quasar-v1.5.1","quasar-v1.5.0","@quasar/app-v1.3.1","@quasar/app-v1.3.0","@quasar/cli-v1.0.3","quasar-v1.4.5","quasar-v1.4.4","@quasar/app-v1.2.4","quasar-v1.4.2","quasar-v1.4.1","@quasar/cli-v1.0.2","@quasar/cli-v1.0.1","@quasar/extras-v1.3.3","quasar-v1.4.0","quasar-v1.3.0","@quasar/app-v1.2.3","quasar-v1.2.7","quasar-v1.2.6","quasar-v1.2.5","quasar-v1.2.4","quasar-v1.2.3","@quasar/app-v1.2.2","quasar-v1.2.2","quasar-v1.2.1","@quasar/app-v1.2.1","@quasar/app-v1.2.0","quasar-v1.2.0","quasar-v1.1.7","@quasar/app-v1.1.4","@quasar/app-v1.1.3","quasar-v1.1.6","quasar-v1.1.5","quasar-v1.1.4","@quasar/extras-v1.3.2","quasar-v1.1.3","@quasar/app-v1.1.2","@quasar/app-v1.1.1","quasar-v1.1.2","@quasar/app-v1.1.0","quasar-v1.1.1","@quasar/app-v1.0.6","quasar-v1.1.0","@quasar/app-v1.0.5","@quasar/extras-v1.3.0","quasar-v1.0.5","@quasar/extras-v1.2.0","@quasar/app-v1.0.4","quasar-v1.0.4","@quasar/app-v1.0.3","@quasar/app-v1.0.2","quasar-v1.0.3","@quasar/app-v1.0.1","v1.0.0","@quasar/extras-v1.1.4","quasar-v1.0.0-rc.5","@quasar/app-v1.0.0-rc.7","@quasar/extras-v1.1.3","@quasar/app-v1.0.0-rc.6","quasar-v1.0.0-rc.4","@quasar/app-v1.0.0-rc.5","quasar-v1.0.0-rc.3","@quasar/app-v1.0.0-rc.4","@quasar/app-v1.0.0-rc.3","@quasar/app-v1.0.0-rc.2","@quasar/cli-v1.0.0-rc.2","quasar-v1.0.0-rc.2","@quasar/app-v1.0.0-rc.1","@quasar/cli-v1.0.0-rc.1","quasar-v1.0.0-beta.24","@quasar/app-v1.0.0-beta.26","@quasar/app-v1.0.0-beta.25","@quasar/app-v1.0.0-beta.24","quasar-v1.0.0-beta.23","@quasar/app-v1.0.0-beta.23","quasar-v1.0.0-beta.22","quasar-v1.0.0-beta.21","@quasar/cli-v1.0.0-beta.7","@quasar/extras-v1.1.2","@quasar/app-v1.0.0-beta.22","quasar-v1.0.0-beta.20","@quasar/app-v1.0.0-beta.21","@quasar/cli-v1.0.0-beta.6","@quasar/cli-v1.0.0-beta.5","quasar-v1.0.0-beta.19","@quasar/app-v1.0.0-beta.20","quasar-v1.0.0-beta.18","@quasar/app-v1.0.0-beta.19","@quasar/app-v1.0.0-beta.18","quasar-v1.0.0-beta.17","@quasar/app-v1.0.0-beta.17","quasar-v1.0.0-beta.16","@quasar/app-v1.0.0-beta.16","quasar-v1.0.0-beta.15","quasar-v1.0.0-beta.14","@quasar/app-v1.0.0-beta.15","@quasar/cli-v1.0.0-beta.4","@quasar/app-v1.0.0-beta.14","quasar-v1.0.0-beta.13","quasar-v1.0.0-beta.12","@quasar/app-v1.0.0-beta.13","@quasar/extras-v1.1.1","quasar-v1.0.0-beta.11","quasar-v","@quasar/app-v1.0.0-beta.12","quasar-v1.0.0-beta.10","@quasar/cli-v1.0.0-beta.3","@quasar/app-v1.0.0-beta.11","quasar-v1.0.0-beta.9","@quasar/app-v1.0.0-beta.10","quasar-v1.0.0-beta.8","quasar-v1.0.0-beta.7","v1.0.0-beta.6","v1.0.0-beta.5","@quasar/app-v1.0.0-beta.9","@quasar/app-v1.0.0-beta.8","extras-v1.1.0","@quasar/babel-preset-app-v1.0.1","v1.0.0-beta.4","v1.0.0-beta.3","v1.0.0-beta.2","quasar-v1.0.0-beta.1","v0.17.19","v0.17.18","v0.17.17","v0.17.16","v0.17.15","v0.17.14","v0.17.13","v0.17.12","v0.17.11","v0.17.10","v0.17.9","v0.17.8","v0.17.7","v0.17.6","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.0","v0.15.15","v0.15.13","v0.15.12","v0.15.11","v0.15.10","v0.15.9","v0.15.8","v0.15.7","v0.15.6","v0.15.5","v0.15.4","v0.15.3","v0.15.2","v0.15.1","v0.15.0","v0.14.5","v0.14.2","v0.14.1","v0.13.6","v0.13.5","v0.13.4","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.0","v0.11","v0.10.3","v0.10.2","v0.10.1","v0.10","v0.9.1","v0.8.2","v0.8.1","v0.8.0","v0.7.0","v0.6.0","v0.5.0","v0.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106106.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N"}]}