AIKIDO-2026-135012
@quasar/app-vite is vulnerable to Cross-Site Scripting (XSS)
59
Medium Risk
This Affects:
@quasar/app-viteTL;DR
Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes without encoding. An application that derives or overrides the nonce from untrusted data can use a quote to terminate the nonce attribute and inject additional attributes or markup into the generated HTML. Cryptographically generated base64 nonces are not directly affected because they contain no HTML attribute delimiters. The fix centralizes nonce handling, validates the value as a non-empty base64 CSP nonce, and HTML-encodes it before rendering.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application derives or overrides ssrContext.nonce from untrusted data during SSR or SSG rendering.
Background info
@quasar/app-vite is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 3.2.0.
How to fix this
Upgrade the @quasar/app-vite library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant