AIKIDO-2026-135012
@quasar/app-vite is vulnerable to Cross-Site Scripting (XSS)
59
CVE Score
Medium
Cross-Site Scripting (XSS)
TL;DR
Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes without encoding. An application that derives or overrides the nonce from untrusted data can use a quote to terminate the nonce attribute and inject additional attributes or markup into the generated HTML. Cryptographically generated base64 nonces are not directly affected because they contain no HTML attribute delimiters. The fix centralizes nonce handling, validates the value as a non-empty base64 CSP nonce, and HTML-encodes it before rendering.
How do I fix this?
Upgrade the @quasar/app-vite library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application derives or overrides ssrContext.nonce from untrusted data during SSR or SSG rendering.
Package
Versions
0.0.1 - 3.2.0
Fixed in 3.3.0Background info
@quasar/app-vite is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 3.2.0.
Links
GitHub Releases
github.com/quasarframework/quasar/releases/tag/%40quasar%2Fapp-vite-v3.3.0github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.