Listen to this Post
The vulnerability stems from improper neutralization of user-supplied data during server-side rendering (SSR) and static site generation (SSG) in @quasar/app-vite. Specifically, several rendering code paths directly interpolate the `ssrContext.nonce` property into quoted HTML tag attributes without prior escaping or validation.
When an application derives or overrides the `ssrContext.nonce` value based on untrusted request data (such as HTTP headers or URL parameters), an attacker can inject quotation marks (e.g., "). This allows the attacker to break out of the intended HTML attribute context. Consequently, additional arbitrary HTML attributes or malicious markup (such as event handlers or `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.