Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A DOM Clobbering vulnerability exists in Quasar's openURL() utility when handling the iOS SafariViewController bridge. The vulnerable implementation only checks whether window.SafariViewController exists before invoking it as a native bridge object. An attacker who can inject HTML content containing a named element such as <a id="SafariViewController" can cause the browser to expose that element as window.SafariViewController. When openURL() is later called in an iOS environment, Quasar incorrectly treats the DOM element as the native bridge object and attempts to invoke bridge methods that do not exist, resulting in: This can cause client-side denial of service and break navigation-related workflows in Quasar applications. Details Quasar provides the openURL() utility to open external URLs. On iOS platforms, this utility supports integration with the native SafariViewController bridge. The vulnerable code is located in: The affected logic is: The issue is that Quasar only…
Recommended action: Upgrade to 2.32.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR() feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in getMatch(). One of those patterns contains a greedy capture followed by two unbounded . scans, so a crafted header costs time proportional to the cube of its length. An 8 KB User-Agent blocks the Node.js event loop for about 4.4 seconds, and a 16 KB one for about 35 seconds. During that time the server answers nobody, so a handful of tiny requests take an SSR site completely offline. Details Platform is in the autoInstalledPlugins array in ui/src/install-quasar.js, so it is installed unconditionally by app.use(Quasar, ...). The generated SSR entry (app-vite/templates/entry/app.js, called from app-vite/templates/entry/server-entry.js) runs that for every HTTP request, and it runs before…
Recommended action: Upgrade to 2.23.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Details File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js (lines 149-176: getAttr() and getHead()) Sink: injectServerMeta() (same file) → ctx.headTags += getHead(data), interpolated verbatim into the raw HTTP response <head by the production SSR template (app-vite/templates/entry/ssr-prod-webserver.js + app-vite/lib/plugins/vite.html.js) Entry point: the public useMeta() composable (ui/src/composables/use-meta/use-meta.js) — the single documented way apps set page title/meta/link/script tags Root Cause getHead() is Quasar's SSR-only serializer that turns the meta/link/script/title data collected from every useMeta() call into a literal HTML string, using plain template-literal interpolation with zero HTML-entity escaping and zero attribute-quote escaping: Contrast this with the client-side equivalent, apply() (same file, used only in the browser post-hydration), which builds the same tags via document.createElement(...) + tag.setAttribute(att, val)…
Recommended action: Upgrade to 2.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root. When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as proto, constructor, or prototype. This can allow attacker-controlled properties to be written to Object.prototype. Details Affected source: Distributed files include: The package root publicly exports extend. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own proto property, the merge can descend into the prototype object and assign attacker-controlled properties onto Object.prototype. PoC Observed output: Expected output: Impact This is a prototype pollution vulnerability. If an application passes user-controlled or partially…
Recommended action: Upgrade to 2.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.