Quasar Framework vulnerabilities

In Quasar Framework prior to 2.32.2, the openURL() utility trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows.

Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.

Quasar Framework prior to 2.22.0 contains a vulnerability in the public extend() utility in ui/src/utils/extend/extend.js that recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.