Description

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-10-06T17:17:24.270Z",
  "pubdate": "2026-10-06T17:17:24.270Z",
  "executiveSummary": "Quasar Framework versions prior to 2.22.0 are susceptible to a Server-Side Cross-Site Scripting (XSS) vulnerability within the server-side rendering (SSR) meta-tag serialization logic.\nThe vulnerability arises from the improper handling of user-supplied data within the getHead() function, which fails to perform necessary HTML text or quoted-attribute encoding when processing metadata.\nAn attacker capable of influencing dynamic page metadata—such as product names or post titles—can break out of the intended HTML context to inject arbitrary executable markup.\nThis vulnerability is limited to the SSR path; the client-side apply() path remains secure as it utilizes standard DOM APIs that perform automatic attribute encoding.\nThe primary risk is the execution of malicious scripts in the context of the victim's browser upon page load, which may lead to session hijacking, unauthorized actions, or unauthorized data exfiltration.\nExploitation requires the attacker to successfully inject malicious payloads into data fields that are subsequently reflected in the page metadata during the server-side rendering process.",
  "technicalDetails": "The root cause of this vulnerability lies in the SSR-only getHead() serializer located in ui/src/plugins/meta/Meta.js. The implementation utilizes a getAttr() helper function that directly interpolates values provided via the useMeta() hook into the generated title, meta, link, and script markup.\nBecause the getAttr() function lacks sufficient sanitization or contextual encoding, it fails to neutralize characters that allow for the termination of the current HTML context (e.g., quotes, brackets, or angle brackets).\nThe injectServerMeta() function subsequently appends this unencoded, potentially malicious output string directly into the raw server-rendered HTML response sent to the client browser.\nAttack flow: 1. The attacker identifies an input vector that contributes to the application's metadata (e.g., user profile data, product database entries). 2. The attacker crafts a payload designed to escape the current HTML attribute or tag context (e.g., '><script>alert(1)</script>'). 3. The server application, during the SSR lifecycle, calls useMeta() with the attacker-supplied payload. 4. The getHead() serializer processes the payload without sanitization, embedding it directly into the response header markup. 5. The server returns the final HTML to the victim's browser. 6. Upon rendering the initial HTML, the victim's browser interprets the injected markup as executable code before the hydration process or DOM-based protection mechanisms can intervene.\nThis vulnerability is restricted to server-side rendering; the client-side apply() mechanism remains unaffected as it relies on DOM APIs (such as element.setAttribute() or textContent assignment) which intrinsically enforce character encoding, thereby preventing XSS in the client-side lifecycle.\nThe impact includes the execution of arbitrary JavaScript in the victim's browser session. Given that this occurs during the initial server response, the payload is executed immediately upon document parsing, providing an attacker with a high-reliability vector for stealing session cookies, performing cross-site request forgery (CSRF), or modifying the DOM to facilitate phishing or further malicious redirects."
}