{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "2.23.3"
              },
              {
                "fixed": "2.2.4"
              },
              {
                "fixed": "3.3.0"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "db082a4407936be7865c7c85dd1862bb213f0c08"
            },
            {
              "fixed": "ba5bd096d06a884878d6b3e8b3bc38ee3ef738f2"
            },
            {
              "fixed": "605f4da74c54bd3c3f3a22350396ca8c1ee0e084"
            },
            {
              "fixed": "61c2bd8a607785fdade72cce20e8faf1de7eee15"
            }
          ],
          "repo": "https://github.com/quasarframework/quasar",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-r5mf-4r5x-q78f"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-497",
      "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106106.json"
  },
  "details": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.",
  "id": "CVE-2026-106106",
  "modified": "2026-10-08T02:30:20.653320591Z",
  "published": "2026-10-06T17:24:07.788Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106106.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-r5mf-4r5x-q78f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106106"
    },
    {
      "type": "FIX",
      "url": "https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its \u003c/script\u003e escape is bypassable"
}