Quasarframework Quasar vulnerabilities

• @quasar app-vite, quasarframework quasar +1 more Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory CVE-2026-106108 Fix available 5.7 MediumOctober 7, 2026
• @quasar app-vite, quasarframework quasar +1 more Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories CVE-2026-106109 Fix available 4.1 MediumOctober 6, 2026
• @quasar app-vite, quasarframework quasar +1 more Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained CVE-2026-106107 Fix available 8.3 HighOctober 6, 2026
• @quasar app-vite, render-ssr-error, quasarframework quasar +2 more Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable CVE-2026-106106 Fix available 7.1 HighOctober 6, 2026
• @quasar app-vite, cli, ssl-certificate +1 more +3 more Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions CVE-2026-106105 Fix available 8.4 HighOctober 6, 2026
• quasarframework quasar Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server CVE-2026-106104 Fix available 8.7 HighOctober 6, 2026
• @quasar icongenie, quasarframework quasar +1 more Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile CVE-2026-106103 Fix available 7.1 HighOctober 6, 2026
• quasarframework quasar Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() CVE-2026-106102 Fix available 10.0 CriticalOctober 6, 2026
• quasarframework quasar Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service CVE-2026-106101 Fix available 3.1 LowOctober 6, 2026
• quasarframework quasar Quasar Framework: Prototype pollution in Quasar extend() utility CVE-2026-73647 Fix available 5.6 MediumJuly 24, 2026