Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106105— Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Quick assessment

Affected
quasarframework quasar
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Quasar 框架是一个用于构建高性能 Vue.js 用户界面的框架。在 @quasar/ssl-certificate 2.1.0、@quasar/cli 5.0.4 以及 @quasar/app-vite 3.3.0 版本之前，@quasar/ssl-certificate 工具会缓存一个组合的私钥和证书 PEM 文件，但未明确设置仅所有者可访问的文件系统权限。其他本地用户若能够读取该缓存，便可复制该密钥，并在信任该证书的环境中伪装成开发阶段的 TLS 端点。此外，生成的证书具备签发证书机构（CA）的能力，包含

CVSS 8.4 · High

Affected Version Matrix 4

VendorProduct Version RangeStatus
@quasar app-vite < 3.3.0 affected
@quasar cli < 5.0.4 affected
@quasar ssl-certificate < 2.1.0 affected
quasarframework quasar < 2.23.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106105

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
Source: CVE Program / CVE List V5
Vulnerability Description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
quasarframework quasar < 2.23.3 -
@quasar app-vite < 3.3.0 -
@quasar cli < 5.0.4 -
@quasar ssl-certificate < 2.1.0 -

II. Public POCs for CVE-2026-106105

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106105

请登录查看更多情报信息。

Other References for CVE-2026-106105 (4)

Same Patch Batch · quasarframework · 2026-10-06 · 8 CVEs total

CVE-2026-106102 10.0 CRITICAL Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
CVE-2026-106104 8.7 HIGH Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Q
CVE-2026-106107 8.3 HIGH Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
CVE-2026-106103 7.1 HIGH Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
CVE-2026-106106 7.1 HIGH Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </sc
CVE-2026-106109 4.1 MEDIUM Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output d
CVE-2026-106101 3.1 LOW Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Caus

IV. Related Vulnerabilities

Same product: quasar
Same vendor: quasarframework
Same weakness: CWE-732

V. Comments for CVE-2026-106105

No comments yet

Leave a comment