CVE-2026-106107

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 3.3.0

Description Several @quasar/app-vite Server-Side Rendering (SSR) and Static Site Generation (SSG) rendering paths interpolate the ssrContext.nonce variable directly into quoted HTML attributes. If an application derives or overrides this value using attacker-controlled data, a quote character can be used to terminate the nonce attribute, enabling the injection of additional attributes or markup into the generated HTML for both development and production environments. Cryptographically generated base64 or base64url nonces are not affected as they do not contain HTML attribute delimiters.

Recommendations Update Quasar Framework to version 3.3.0.