Quasar Framework’s SSR and SSG rendering paths prior to version 3.3.0 interpolated the value of ssrContext.nonce directly into quoted HTML attributes. If an attacker can cause this value to contain an apostrophe or quotation mark, the attribute delimiter can be terminated and arbitrary attributes or markup can be appended to the generated HTML. This flaw is a classic example of CWE‑79 (Cross‑Site Scripting) and also involves unsanitised string concatenation (CWE‑116). The vulnerability allows the injection of potentially malicious code or markup into the output served to users, resulting in stored or reflected XSS that could be used for defacement, credential theft, or further exploitation.

The issue affects the Quasar Framework and its @quasar/app‑vite package. All releases before 3.3.0 are vulnerable because the nonce value was not safely constrained. The fix was released in the 3.3.0 update. Users of earlier app‑vite or Quasar Framework versions should be aware that any SSR or SSG output could contain injected content if ssrContext.nonce is attacker‑controlled.

The CVSS score is 8.3, indicating high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the SSR or SSG rendering process, requiring the attacker to provide or influence ssrContext.nonce. If attacker control is achieved, the exploit is straightforward: crafted nonce values can break attribute quoting and inject arbitrary markup. The impact is a potentially complete compromise of the client‑side context for any user viewing the affected content.