CVE-2026-106102

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

CVE-2026-106102

The Quasar Framework contains a vulnerability in the SSR-only getHead() serializer located in ui/src/plugins/meta/Meta.js. Prior to version 2.22.0 , the getAttr() function interpolated values from useMeta() into title , meta , link , and script markup without proper HTML text or quoted-attribute ...

EUVD-2026-93517

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...