Is CVE-2026-106102 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106102 being exploited in the wild.

How severe is CVE-2026-106102?

Critical severity, with a CVSS score of 10, published 6 October 2026.

Which products and versions are affected?

quasar (npm) < 2.22.0, SEMVER:introduced=0,fixed=2.22.0; Quasar Framework Quasar before 2.22.0.

How is CVE-2026-106102 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106102?

Check whether you run quasar (npm) or Quasar Framework Quasar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106102: Quasar Framework SSR meta serialization XSS

Q: Which products and versions are affected?

quasar (npm) < 2.22.0, SEMVER:introduced=0,fixed=2.22.0; Quasar Framework Quasar before 2.22.0.

Q: Is there a fix for CVE-2026-106102?

Yes. quasar (npm): upgrade to 2.22.0 or later. Until then: Do not pass untrusted or unsanitized user content to the innerHTML property of script entries or the content of noscript entries in useMeta(). Prefer regular meta properties such as content for dynamic user-provided text. [{"kind":"disclosed","at":"2026-10-06"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-106102 · Severity: critical · CVSS 10 · Published 2026-10-06

Quasar Framework is a Vue.js UI framework used to build web applications. Prior to version 2.22.0, server-side rendering (SSR) of page metadata such as titles and meta tags failed to encode user-supplied content, allowing attackers to inject malicious HTML and JavaScript. An attacker controlling page metadata like post titles or product names can execute arbitrary code in users' browsers.

Technologies: quasar (npm). Vendors: npm.

Quick answers

Is CVE-2026-106102 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106102 being exploited in the wild.
How severe is CVE-2026-106102?: Critical severity, with a CVSS score of 10, published 6 October 2026.
Which products and versions are affected?: quasar (npm) < 2.22.0, SEMVER:introduced=0,fixed=2.22.0; Quasar Framework Quasar before 2.22.0.
Is there a fix for CVE-2026-106102?: Yes. quasar (npm): upgrade to 2.22.0 or later. Until then: Do not pass untrusted or unsanitized user content to the innerHTML property of script entries or the content of noscript entries in useMeta(). Prefer regular meta properties such as content for dynamic user-provided text.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-06"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106102 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106102?: Check whether you run quasar (npm) or Quasar Framework Quasar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

quasar (npm): upgrade to 2.22.0 or later
```
npm install quasar@2.22.0
```

Do not pass untrusted or unsanitized user content to the innerHTML property of script entries or the content of noscript entries in useMeta(). Prefer regular meta properties such as content for dynamic user-provided text.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-06"}]

Technical details

The getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate dynamic metadata into HTML markup without proper HTML entity or attribute encoding. The vulnerable injectServerMeta() function appended unencoded output directly to the server response. Client-side rendering is not affected because it uses DOM APIs that automatically encode attributes. An unauthenticated attacker who can control metadata fields (post titles, product names, display names) can inject executable markup and break out of the intended HTML context before client hydration.

Affected products

Quasar Framework Quasar before 2.22.0

Identifiers

CVE-2026-106102
GHSA-pq96-jpmf-w254

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.