GHSA-PQ96-JPMF-W254 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

NPM: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead vulnerability discovered by ? in WordPress Npm quasar versions 2.22.0...

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js lines 149-176: getAttr and getHead Sink: injectServerMeta same file → ctx.headTags += getHeaddata, interpolated verbatim into the raw HTTP response by the production SSR template...

EUVD-2026-93517

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead...

CVE-2026-106102

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

CVE-2026-106102

The Quasar Framework contains a vulnerability in the SSR-only getHead() serializer located in ui/src/plugins/meta/Meta.js. Prior to version 2.22.0 , the getAttr() function interpolated values from useMeta() into title , meta , link , and script markup without proper HTML text or quoted-attribute ...

CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

PT-2026-106810

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.22.0 Description The SSR-only getHead serializer in ui/src/plugins/meta/Meta.js uses getAttr to interpolate values provided via useMeta into title, meta, link, and script markup without proper HTML text or...

CVE-2026-106102: Improper Neutralization of Input During Web Page Generation

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead serializer in ui/src/plugins/meta/Meta.js used getAttr to interpolate values supplied through useMeta into title, meta, link, and script markup without HTML text or...

PT-2020-22417

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions, including PriorityQueue::GetHead,...

PT-2020-22418

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported, classified as an UNKNOWN READ. The crash state includes functions such as not::MessageQueue::GetHead,...