{"id":"CVE-2026-106105","revision":"664b575dc9a441bcbc1ce432a18b2e4a","records":[{"revision":"664b575dc9a441bcbc1ce432a18b2e4a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106105","aliases":[],"title":"Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.","state":0,"publishedAt":"2026-10-06T17:20:36.923+00:00","modifiedAt":"2026-10-06T17:53:57.23+00:00","affected":[{"ecosystem":"Vendor product","name":"quasar","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"quasarframework\",\n                    \"product\": \"quasar\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.23.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"app-vite","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@quasar\",\n                    \"product\": \"app-vite\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.3.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"cli","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@quasar\",\n                    \"product\": \"cli\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.0.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"ssl-certificate","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@quasar\",\n                    \"product\": \"ssl-certificate\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.4,"severity":"HIGH"}],"references":["https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv","https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575","https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106105","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106105","identifiers":["CVE-2026-106105"]},"retained":false,"historicalAffected":[]}],"coverage":[]}