Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Description

File: ui/src/utils/meta/Meta.js — actually ui/src/plugins/meta/Meta.js (lines 149-176: getAttr() and getHead()) Sink: injectServerMeta() (same file) → ctx.headTags += getHead(data), interpolated verbatim into the raw HTTP response <head> by the production SSR template (app-vite/templates/entry/ssr-prod-webserver.js + app-vite/lib/plugins/vite.html.js) Entry point: the public useMeta() composable (`ui/src/composables/use-meta/use-meta.

Recommendation

Update the quasar package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.22.0
• Patched version(s): 2.22.0

References

• GHSA-pq96-jpmf-w254
• CVE-2026-106102
• CWE-116
• CWE-79
• CAPEC-310