High, CVSS 7.1npmAmendedPublished
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable
CVE-2026-106106 · GHSA-r5mf-4r5x-q78f
- Affected
- npm @quasar/render-ssr-error <= 2.2.3
- Fixed in
- 2.2.4· Vendor fix available
- Issue
- The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a <script element behind a replaceAll('</script', ...) guard that is ASCII-case-sensitive and requires a literal , so </SCRIPT, </script and </script/ all escape the element and give script execution in the dev server's origin. Details renderSSRError() builds the page by splicing a JSON blob into a prebuilt bundle (utils/render-ssr-error/src/index.js): before and after are the two halves of the compiled error-page UI, split inside a <script type="module" element, so data is emitted as a JS object literal in raw script text. The data itself comes from…
Recommended action: Upgrade to 2.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.