A development‑only error page in Quasar Framework exposed diagnostic data, including the process environment, request headers, and cookies, to any client that triggered an SSR or SSG render failure. The escaping logic accepted only one lowercase "</script>" spelling, allowing intentional script tag termination when an attacker could insert case‑variant or delimiter‑variant closing tags. Even though the payload would execute only in the developer’s browser, the flaw provides a vector for arbitrary code execution when the developer visits the error page with crafted data.

Affected components are @quasar:app‑vite, @quasar:render‑ssr‑error, and the broader quasarframework:quasar project. Versions older than @quasar/app‑vite 3.3.0 and @quasar/render‑ssr‑error 2.2.4 are impacted; the issue is fixed in those releases.

The vulnerability scores a CVSS of 7.1, indicating a moderate severity, with no EPSS score available and it has not been catalogued in CISA’s KEV list. An attack requires network proximity to the development server, which by default listens on all interfaces. Once a render failure occurs, an attacker can read sensitive environment data and, via the escape bypass, inject markup or script into the developer’s session. The risk is confined to development environments and is mitigated when the server is bound to localhost or otherwise isolated.