Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Fix availableCritical · CVSS 10EPSS 0.30%

Published Oct 7, 2026 · updated Oct 7, 2026

What to do

  1. Upgrade to a fixed version: quasar 2.22.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmquasar

Vulnerable versions
< 2.22.0
Fixed in
2.22.0

Check your project: npm ls quasar --all

Is quasar@2.22.0 safe to install? See the upgrade verdict →

Sources

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') · CWE-116 Improper Encoding or Escaping of Output

← All critical vulnerabilities