CVE-2026-106107

{
  "etk_id": "ETK-2026-791",
  "cve_id": "CVE-2026-106107",
  "display_id": "CVE-2026-106107",
  "ghsa_id": "GHSA-5m6h-8g35-p3m7",
  "euvd_id": "EUVD-2026-93572",
  "status": "published",
  "anchor_state": "anchored",
  "title": "HTML attribute injection in Quasar app-vite SSR and SSG",
  "summary": "Quasar app-vite SSR and SSG output is affected when rendering uses an unsafe application-provided nonce value. An attacker who can influence that nonce may alter generated HTML attributes or markup. Applications using generated base64 or base64url nonces are not affected by this condition.",
  "mitigation": "Upgrade quasar to 2.23.4 and app-vite to 3.3.0 or later. Until upgraded, ensure nonce values are generated server-side and cannot be overridden or derived from untrusted input.",
  "vendor": "quasarframework",
  "product": "quasar",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 3.2.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.3.0"
      ],
      "package_name": "@quasar/app-vite",
      "purl": "pkg:npm/@quasar/app-vite"
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0027,
  "epss_percentile": 0.1738,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 19.141648933333332,
  "t0_at": "2026-10-06T17:26:19.769000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-06T18:02:09.142886+00:00",
      "days": 0.024877012569444443,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T17:26:19.769000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-06T17:26:19.769000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-06T17:26:19.769000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106107"
    }
  }
}