CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Summary

The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a <script> element behind a replaceAll('</script>', ...) guard that is ASCII-case-sensitive and requires a literal >, so </SCRIPT>, </script > and </script/> all escape the element and give script execution in the dev server's origin.

Details

renderSSRError() builds the page by splicing a JSON blob into a prebuilt bundle (utils/render-ssr-error/src/index.js):

errorHtml:
  before +
  JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) +
  after

before and after are the two halves of the compiled error-page UI, split inside a <script type="module"> element, so data is emitted as a JS object literal in raw script text. The data itself comes from utils/render-ssr-error/src/env.js:

function getEnvironmentVariablesData () {
  return Object.keys(process.env).reduce((acc, name) => {
    acc[ name ] = process.env[ name ]
    return acc
  }, {})
}

export function getEnv (req) {
  return {
    Request: getRequestData(req),
    Headers: getHeadersData(req),
    Cookies: getCookiesData(req),
    'Shell environment variables': getEnvironmentVariablesData()
  }
}

The page is served by serve.devError({ err, req }) in app-vite/lib/modes/ssr/ssr-devserver.js and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because app-vite/lib/quasar-config-file.js overrides Vite's localhost default:

} else if (!cfg.devServer.host) {
  cfg.devServer.host = '0.0.0.0'
}

The escape fails because the HTML tokenizer ends script raw text on </ followed by a case-insensitive script followed by any of tab, newline, form feed, space, / or >. replaceAll with a string pattern matches one exact spelling. </SCRIPT>, </ScRiPt>, </script > and </script/> are all untouched and all close the element. JSON.stringify does not escape < or >, and cookie values are additionally run through decodeURIComponent before being placed in the blob, so percent-encoded payloads decode into working markup.

The project already implements this correctly elsewhere. ui/src/plugins/meta/Meta.js uses a case-insensitive pattern with no trailing >:

function protectRawText (value, tagName) {
  return String(value).replaceAll(new RegExp(`</${tagName}`, 'gi'), `<\\/${tagName}`)
}

PoC

Harness that replicates the dev server's error branch using the published @quasar/[email protected], with two canary values planted in the environment:

import http from 'node:http'
import renderSSRError from '@quasar/render-ssr-error'

process.env.AWS_SECRET_ACCESS_KEY = 'CANARY_AWS_SECRET_dev_machine_9f3a1c'
process.env.NPM_TOKEN = 'CANARY_npm_TOKEN_abcdef'

http.createServer((req, res) => {
  const err = new Error('Cannot read properties of undefined (reading "x")')
  const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() })
  res.writeHead(500, errorHeaders)
  res.end(errorHtml)
}).listen(3200, '0.0.0.0')

Disclosure needs no payload at all. A plain GET / returns a 957 KB page containing both canaries:

ENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page
  -> CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef

For the injection, the payload goes in an ordinary request header. JSON.stringify escapes " as \", so the handler uses single quotes:

<TAG><img src=/nonexistent-image onerror='window.__QPWN=document.domain+":"+location.port'>

Loaded in…

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Summary

The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a <script> element behind a replaceAll('</script>', ...) guard that is ASCII-case-sensitive and requires a literal >, so </SCRIPT>, </script > and </script/> all escape the element and give script execution in the dev server's origin.

Details

renderSSRError() builds the page by splicing a JSON blob into a prebuilt bundle (utils/render-ssr-error/src/index.js):

errorHtml:
  before +
  JSON.stringify(data).replaceAll('</script>', String.raw`<\/script>`) +
  after

before and after are the two halves of the compiled error-page UI, split inside a <script type="module"> element, so data is emitted as a JS object literal in raw script text. The data itself comes from utils/render-ssr-error/src/env.js:

function getEnvironmentVariablesData () {
  return Object.keys(process.env).reduce((acc, name) => {
    acc[ name ] = process.env[ name ]
    return acc
  }, {})
}

export function getEnv (req) {
  return {
    Request: getRequestData(req),
    Headers: getHeadersData(req),
    Cookies: getCookiesData(req),
    'Shell environment variables': getEnvironmentVariablesData()
  }
}

The page is served by serve.devError({ err, req }) in app-vite/lib/modes/ssr/ssr-devserver.js and by the SSG equivalent, which the generated render middleware calls on any render exception. The dev server listens on every interface because app-vite/lib/quasar-config-file.js overrides Vite's localhost default:

} else if (!cfg.devServer.host) {
  cfg.devServer.host = '0.0.0.0'
}

The escape fails because the HTML tokenizer ends script raw text on </ followed by a case-insensitive script followed by any of tab, newline, form feed, space, / or >. replaceAll with a string pattern matches one exact spelling. </SCRIPT>, </ScRiPt>, </script > and </script/> are all untouched and all close the element. JSON.stringify does not escape < or >, and cookie values are additionally run through decodeURIComponent before being placed in the blob, so percent-encoded payloads decode into working markup.

The project already implements this correctly elsewhere. ui/src/plugins/meta/Meta.js uses a case-insensitive pattern with no trailing >:

function protectRawText (value, tagName) {
  return String(value).replaceAll(new RegExp(`</${tagName}`, 'gi'), `<\\/${tagName}`)
}

PoC

Harness that replicates the dev server's error branch using the published @quasar/[email protected], with two canary values planted in the environment:

import http from 'node:http'
import renderSSRError from '@quasar/render-ssr-error'

process.env.AWS_SECRET_ACCESS_KEY = 'CANARY_AWS_SECRET_dev_machine_9f3a1c'
process.env.NPM_TOKEN = 'CANARY_npm_TOKEN_abcdef'

http.createServer((req, res) => {
  const err = new Error('Cannot read properties of undefined (reading "x")')
  const { errorHeaders, errorHtml } = renderSSRError({ err, req, rootFolder: process.cwd() })
  res.writeHead(500, errorHeaders)
  res.end(errorHtml)
}).listen(3200, '0.0.0.0')

Disclosure needs no payload at all. A plain GET / returns a 957 KB page containing both canaries:

ENV DISCLOSURE (plain GET, no injection): 2/2 canary secrets present in the 500 page
  -> CANARY_AWS_SECRET_dev_machine_9f3a1c, CANARY_npm_TOKEN_abcdef

For the injection, the payload goes in an ordinary request header. JSON.stringify escapes " as \", so the handler uses single quotes:

<TAG><img src=/nonexistent-image onerror='window.__QPWN=document.domain+":"+location.port'>

Loaded in…