What is CVE-2026-106102?

CVE-2026-106102 is a critical-severity vulnerability in Quasarframework Quasar, classified under Cross-site Scripting. CVSS score: 10.0/10. Published 2026-10-06.

How severe is CVE-2026-106102?

Critical severity. CVSS v3 base score is 10.0 out of 10.

XSS in Quasarframework Quasar

CVE-2026-106102

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-10-06 · last modified 2026-10-06.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Quasarframework Quasar — versions < 2.22.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-106102?: CVE-2026-106102 is a critical-severity vulnerability in Quasarframework Quasar, classified under Cross-site Scripting. CVSS score: 10.0/10. Published 2026-10-06.
How severe is CVE-2026-106102?: Critical severity. CVSS v3 base score is 10.0 out of 10.