CVE-2026-106102

10 CRITICALpublic exploit available

Published 2026-10-06 · Updated 2026-10-06

AI risk analysis

Summary: The flaw allows an attacker to inject executable markup by manipulating metadata, potentially leading to code execution or data exfiltration.
Exploitability: Exploitation is moderately hard as it requires the attacker to influence dynamic page metadata, but preconditions are common in many web applications.
Blast radius: If exploited, the impact could be severe, as it could lead to arbitrary code execution on the client side during hydration.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Quasar Framework version 2.22.0 or later.

rcewebssrfmetadata

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses

CWE-79, CWE-116

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.