EUVD-2026-93570

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions...

EUVD-2026-93572

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained...

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

EUVD-2026-93573

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories...

GHSA-Q9MQ-245R-4G93 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

CVE-2026-106107

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...

CVE-2026-106109

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106105

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106109

The Quasar Framework 's @quasar/app-vite component (versions 1.0.0 through 3.3.0) contains a vulnerability where it recursively removes the build.distDir before building. The root cause is a lack of validation to reject sensitive paths such as the project root, user home directory, filesystem roo...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

CVE-2026-106107

The Quasar Framework (prior to version 3.3.0 ) contains a vulnerability where several @quasar/app-vite SSR and SSG rendering paths interpolate ssrContext.nonce directly into quoted HTML attributes without sufficient constraint. If an application allows an attacker to control or derive this value,...

CVE-2026-106107 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controll...

PT-2026-106825

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 3.3.0 Description Several @quasar/app-vite Server-Side Rendering SSR and Static Site Generation SSG rendering paths interpolate the ssrContext.nonce variable directly into quoted HTML attributes. If an...

PT-2026-106823

Name of the Vulnerable Software and Affected Versions @quasar/ssl-certificate versions prior to 2.1.0 @quasar/cli versions prior to 5.0.4 @quasar/app-vite versions prior to 3.3.0 Description The @quasar/ssl-certificate utility caches a combined private key and certificate PEM without applying...

PT-2026-106826

Name of the Vulnerable Software and Affected Versions Quasar Framework versions 1.0.0 through 3.2.9 Description The @quasar/app-vite component recursively removes the resolved build.distDir before the build process begins. It fails to reject the project root, user home directory, filesystem roots...