4vulnerabilities
- Critical1 (25.0%)
- High1 (25.0%)
- Medium0 (0.0%)
- Moderate1 (25.0%)
- Low1 (25.0%)
quasar
Ecosystem: npm
Downloads: 1.73 Mln
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 1LowAffects 1 version
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 3 vulnerabilities
- Critical: 1
- High: 1
- Medium: 0
- Moderate: 0
- Low: 1
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (4)
Known vulnerabilities affecting quasar, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-68jq-fhch-4xq4 | High | Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server### Summary One unauthenticated request with a crafted `User-Agent` stalls a Quasar SSR server for seconds. Quasar auto-installs its `Platform` plugin on every server-side render, and `Platform.parseSSR()` feeds the raw, unbounded `User-Agent` request header into a chain of backtracking regular expressions in `getMatch()`. One of those patterns contains a greedy capture followed by two unbounded `.*` scans, so a crafted header costs time proportional to the cube of its length. An 8 KB `User-Agent` blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. Duri |
| GitHub (opens in a new tab) | |
| GHSA-89vp-x45c-52cq | Low | Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service### Summary A DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge. The vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `<a id="SafariViewController">` can cause the browser to expose that element as `window.SafariViewController`. When `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to i |
| GitHub (opens in a new tab) | |
| GHSA-pq96-jpmf-w254 | Critical | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()## Vulnerability Details **File**: `ui/src/utils/meta/Meta.js` — actually `ui/src/plugins/meta/Meta.js` (lines 149-176: `getAttr()` and `getHead()`) **Sink**: `injectServerMeta()` (same file) → `ctx.headTags += getHead(data)`, interpolated verbatim into the raw HTTP response `<head>` by the production SSR template (`app-vite/templates/entry/ssr-prod-webserver.js` + `app-vite/lib/plugins/vite.html.js`) **Entry point**: the public `useMeta()` composable (`ui/src/composables/use-meta/use-meta.js`) — the single documented way apps set page title/meta/link/script tags ### Root Cause `getHead()` i |
| GitHub (opens in a new tab) | |
| GHSA-3r53-75j5-3g7j | Moderate | Quasar: Prototype pollution in the extend() utility### Summary `quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root. When `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as `__proto__`, `constructor`, or `prototype`. This can allow attacker-controlled properties to be written to `Object.prototype`. ### Details Affected source: ```text src/utils/extend/extend.js ``` Di |
| GitHub (opens in a new tab) |
- GHSA-68jq-fhch-4xq4HighQuasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
< 2.23.3
### Summary One unauthenticated request with a crafted `User-Agent` stalls a Quasar SSR server for seconds. Quasar auto-installs its `Platform` plugin on every server-side render, and `Platform.parseSSR()` feeds the raw, unbounded `User-Agent` request header into a chain of backtracking regular expressions in `getMatch()`. One of those patterns contains a greedy capture followed by two unbounded `.*` scans, so a crafted header costs time proportional to the cube of its length. An 8 KB `User-Agent` blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. Duri
CVE: CVE-2026-106104
- GHSA-89vp-x45c-52cqLowQuasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
< 2.32.2
### Summary A DOM Clobbering vulnerability exists in Quasar's `openURL()` utility when handling the iOS `SafariViewController` bridge. The vulnerable implementation only checks whether `window.SafariViewController` exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as `<a id="SafariViewController">` can cause the browser to expose that element as `window.SafariViewController`. When `openURL()` is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to i
CVE: CVE-2026-106101
- GHSA-pq96-jpmf-w254CriticalQuasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
< 2.22.0
## Vulnerability Details **File**: `ui/src/utils/meta/Meta.js` — actually `ui/src/plugins/meta/Meta.js` (lines 149-176: `getAttr()` and `getHead()`) **Sink**: `injectServerMeta()` (same file) → `ctx.headTags += getHead(data)`, interpolated verbatim into the raw HTTP response `<head>` by the production SSR template (`app-vite/templates/entry/ssr-prod-webserver.js` + `app-vite/lib/plugins/vite.html.js`) **Entry point**: the public `useMeta()` composable (`ui/src/composables/use-meta/use-meta.js`) — the single documented way apps set page title/meta/link/script tags ### Root Cause `getHead()` i
CVE: CVE-2026-106102
- GHSA-3r53-75j5-3g7jModerateQuasar: Prototype pollution in the extend() utility
< 2.22.0
### Summary `quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root. When `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as `__proto__`, `constructor`, or `prototype`. This can allow attacker-controlled properties to be written to `Object.prototype`. ### Details Affected source: ```text src/utils/extend/extend.js ``` Di
CVE: CVE-2026-73647