CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js (lines 149-176: getAttr() and getHead()) Sink: injectServerMeta() (same file) → ctx.headTags += getHead(data), interpolated verbatim into the raw HTTP response <head> by the production SSR template (app-vite/templates/entry/ssr-prod-webserver.js + app-vite/lib/plugins/vite.html.
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.3% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- quasar (npm) < 2.22.0, fixed in 2.22.0 · GHSA-pq96-jpmf-w254