CyberRota Analysis
AI-GeneratedThe Quasar Framework's openURL() utility prior to version 2.32.2 is vulnerable to a TypeError caused by attacker-controlled HTML, which can disrupt external navigation and critical workflows such as login and payment redirects. This issue primarily affects applications using QEditor, QSelect, and QChatMessage components that render untrusted HTML in iOS environments. Developers utilizing the Quasar Framework should prioritize updating to version 2.32.2 to mitigate potential disruptions in user experience and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows. QSelect and QChatMessage HTML-rendering configurations can expose the same trigger when they render attacker-controlled HTML. This issue is fixed in version 2.32.2.