Detections
Analytics

SCA: security update for @quasar/app-vite (GHSA-5m6h-8g35-p3m7)

high Tenable Self-Hosted Container Security Plugin ID 473694

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0,
 several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted
 HTML attributes. An application that derives or overrides this value with attacker-controlled data can
 allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated
 HTML across development and production SSR or SSG output. Cryptographically generated base64 or base64url
 nonces are not affected because they lack HTML attribute delimiters. This issue is fixed in version 3.3.0.
 (CVE-2026-106107)

Solution

Update the @quasar/app-vite library and its related packages to version 3.3.0 or later.

See Also

https://github.com/advisories/GHSA-5m6h-8g35-p3m7

Plugin Details

Severity: High

ID: 473694

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/7/2026

Updated: 10/7/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 10.07

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-106107

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 4.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/6/2026

Reference Information

CVE: CVE-2026-106107