Quasar caches development TLS keys with lax file permissions
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
The @quasar/ssl-certificate package before 2.1.0, @quasar/cli before 5.0.4, @quasar/app-vite before 3.3.0, and the quasar package before 2.23.3 are affected. The utility caches a combined private key and certificate PEM without explicitly applying owner-only file permissions (CWE-732). A local user who can read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| quasarframework | quasar | before 2.23.3 | 2.23.3 | Patch available | CNA |
| @quasar | app-vite | before 3.3.0 | 3.3.0 | Patch available | CNA |
| @quasar | cli | before 5.0.4 | 5.0.4 | Patch available | CNA |
| @quasar | ssl-certificate | before 2.1.0 | 2.1.0 | Patch available | CNA |
| — | @quasar/ssl-certificate (npm) | before 2.1.0 | 2.1.0 | Patch available | GHSA-fh39-c73x-5pjv |
| — | @quasar/cli (npm) | before 5.0.4 | 5.0.4 | Patch available | GHSA-fh39-c73x-5pjv |
| — | @quasar/app-vite (npm) | before 3.3.0 | 3.3.0 | Patch available | GHSA-fh39-c73x-5pjv |
- quasar Vendorquasarframework Affected before 2.23.3 Fixed in 2.23.3 Patch available CNA
- app-vite Vendor@quasar Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA
- cli Vendor@quasar Affected before 5.0.4 Fixed in 5.0.4 Patch available CNA
- ssl-certificate Vendor@quasar Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
- @quasar/ssl-certificate (npm) Vendor— Affected before 2.1.0 Fixed in 2.1.0 Patch available GHSA-fh39-c73x-5pjv
- @quasar/cli (npm) Vendor— Affected before 5.0.4 Fixed in 5.0.4 Patch available GHSA-fh39-c73x-5pjv
- @quasar/app-vite (npm) Vendor— Affected before 3.3.0 Fixed in 3.3.0 Patch available GHSA-fh39-c73x-5pjv
Remediation
Upgrade @quasar/ssl-certificate to 2.1.0, @quasar/cli to 5.0.4, and @quasar/app-vite to 3.3.0. The sources list no fixed version for quasar.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA quasar (quasarframework) Fixed in 2.23.3
- Fix · CNA app-vite (@quasar) Fixed in 3.3.0
- Fix · CNA cli (@quasar) Fixed in 5.0.4
- Fix · CNA ssl-certificate (@quasar) Fixed in 2.1.0
- Fix · GHSA-fh39-c73x-5pjv @quasar/ssl-certificate (npm) Fixed in 2.1.0 Advisory →
- Fix · GHSA-fh39-c73x-5pjv @quasar/cli (npm) Fixed in 5.0.4 Advisory →
- Fix · GHSA-fh39-c73x-5pjv @quasar/app-vite (npm) Fixed in 3.3.0 Advisory →
Timeline
- 2026-10-06 Threatist record created from CVE-2026-106105
- 2026-10-07 Alias added: GHSA-fh39-c73x-5pjv
- 2026-10-07 Fix available: npm/@quasar/[email protected], npm/@quasar/[email protected], npm/@quasar/[email protected] · GHSA-fh39-c73x-5pjv
- 2026-10-07 CVSS score added · GHSA-fh39-c73x-5pjv
- 2026-10-07 Weakness changed · GHSA-fh39-c73x-5pjv
- 2026-10-07 6 new references · GHSA-fh39-c73x-5pjv
References
Other 5
- https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv
- https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575
- https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
- https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4
- https://github.com/quasarframework/quasar
More quasarframework vulnerabilities
- TI-2026-68624 Regex backtracking on User-Agent header stalls Quasar SSR servers CVSS 4.0HIGH 8.7
- TI-2026-68626 Quasar SSR dev error page leaks environment secrets and enables XSS CVSS 4.0HIGH 7.1
- TI-2026-51731 Quasar Framework: Prototype pollution in Quasar extend() utility CVSS 3.1MEDIUM 5.6
- TI-2026-68622 Cross-site scripting in Quasar Framework SSR meta tags CVSS 3.1CRITICAL 10.0
- TI-2026-68621 Type confusion in quasarframework quasar CVSS 3.1LOW 3.1
- TI-2026-68627 Unsafe nonce interpolation in Quasar app-vite SSR and SSG output CVSS 4.0HIGH 8.3
Sources
- CVE-2026-106105 · CVE Program
- CVE-2026-106105 · NVD
- FIRST EPSS
- GHSA-fh39-c73x-5pjv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences