CVE-2026-106106.

Disclosure summary

### Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in `process.env`, every request header and every cookie into the HTTP response, and the dev server binds `0.0.0.0` by default. Any host that can reach the port therefore gets the developer's cloud keys, registry tokens and database URLs from a single unauthenticated GET. The same page embeds that data inside a `` element behind a `replaceAll('', ...)` guard that is ASCII-case-sensitive and requires a literal `>`, so ``, `` and `` all escape the element and give script execution in the dev server's origin. ### Details `renderSSRError()` builds the page by splicing a JSON blob into a prebuilt bundle (`utils/render-ssr-error/src/index.js`): ```js errorHtml: before + JSON.stringify(data).replaceAll('', String.raw``) + after ``` `before` and `after` are the two halves of the compiled error-page UI, split inside a `` element, so `data` is emitted as a JS object literal in raw script text. The data itself comes from `utils/render-ssr-error/src/env.js`: ```js function getEnvironmentVariablesData () { return Object.keys(process.env).reduce((acc, name) => { acc[ name ] =

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

Original records & references

• NIST NVD record
• CVE Program record
• github.com — Reviewed advisory

PUBLISHED 2026-10-07T12:16:12-04:00
MODIFIED 2026-10-07T12:16:14-04:00
INGESTED 2026-10-08T12:05:11-04:00