AIKIDO-2026-738628
@quasar/app-vite is vulnerable to Exposure of Sensitive Information
65
Medium Risk
This Affects:
@quasar/app-viteTL;DR
The SSR and SSG development error page rendered by @quasar/app-vite serializes the entire shell environment, all request headers, and all cookies into the HTTP response, and the development server binds to all interfaces by default. Any host that can reach the port can retrieve environment secrets such as cloud keys and registry tokens from a single unauthenticated request when a render throws. The page also embeds that data inside a script element behind a case-sensitive escape that literal variants of the closing tag bypass, enabling script execution in the development server origin. The fix omits environment variables from the page and applies HTML-safe escaping to the remaining diagnostic data.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the SSR or SSG development server where other hosts on your network can reach its port.
Background info
@quasar/app-vite is vulnerable to Exposure of Sensitive Information in versions 0.0.1 - 3.2.0.
How to fix this
Upgrade the @quasar/app-vite library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant