quasarframework quasar
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106108 | >= 2.22.0, < 2.23.3 | Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory | MEDIUM 5.7 | 0.1 % | ||
| CVE-2026-106109 | >= 2.7.0, < 2.23.3 | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories | MEDIUM 4.1 | 0.1 % | ||
| CVE-2026-106107 | < 2.23.4 | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained | HIGH 8.3 | 0.3 % | ||
| CVE-2026-106106 | < 2.23.3 | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable | HIGH 7.1 | 0.3 % | ||
| CVE-2026-106105 | < 2.23.3 | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions | HIGH 8.4 | 0.1 % | ||
| CVE-2026-106104 | < 2.23.3 | Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server | HIGH 8.7 | 0.4 % | ||
| CVE-2026-106103 | < 2.22.0 | Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile | HIGH 7.1 | 0.3 % | ||
| CVE-2026-106102 | < 2.22.0 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() | CRITICAL 10.0 | 0.3 % | ||
| CVE-2026-106101 | < 2.32.2 | Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service | LOW 3.1 | 0.3 % | ||
| CVE-2026-73647 | < 2.22.0 | Quasar Framework: Prototype pollution in Quasar extend() utility | MEDIUM 5.6 | 0.4 % |