AIKIDO-2026-738628
@quasar/app-vite is vulnerable to Exposure of Sensitive Information
65
CVE Score
Medium
Exposure of Sensitive Information
TL;DR
The SSR and SSG development error page rendered by @quasar/app-vite serializes the entire shell environment, all request headers, and all cookies into the HTTP response, and the development server binds to all interfaces by default. Any host that can reach the port can retrieve environment secrets such as cloud keys and registry tokens from a single unauthenticated request when a render throws. The page also embeds that data inside a script element behind a case-sensitive escape that literal variants of the closing tag bypass, enabling script execution in the development server origin. The fix omits environment variables from the page and applies HTML-safe escaping to the remaining diagnostic data.
How do I fix this?
Upgrade the @quasar/app-vite library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the SSR or SSG development server where other hosts on your network can reach its port.
Package
Versions
0.0.1 - 3.2.0
Fixed in 3.3.0Background info
@quasar/app-vite is vulnerable to Exposure of Sensitive Information in versions 0.0.1 - 3.2.0.
Links
GitHub Releases
github.com/quasarframework/quasar/releases/tag/%40quasar%2Fapp-vite-v3.3.0github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.