{"id":"EUVD-2026-93570","enisaUuid":"52b258c0-d2be-351f-901b-17e8f3f67ebf","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.","datePublished":"Oct 6, 2026, 5:20:36 PM","dateUpdated":"Oct 6, 2026, 5:53:57 PM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv\nhttps://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4\n","aliases":"CVE-2026-106105\nGHSA-fh39-c73x-5pjv\n","assigner":"GitHub_M","epss":0.07,"enisaIdProduct":[{"id":"3281ce9f-d96d-3217-8ad0-039f27055bfe","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 5.0.4"},{"id":"59f41b91-2480-324c-9cd0-1cdefbe39bcc","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"\u003c 2.23.3"},{"id":"5f46d3fb-704f-3b97-98d5-47ec039e5cd6","product":{"name":"ssl-certificate","vendor":{"name":"@quasar"}},"product_version":"\u003c 2.1.0"},{"id":"920000fa-2f3c-3c6e-a627-4b5795ecce08","product":{"name":"app-vite","vendor":{"name":"@quasar"}},"product_version":"\u003c 3.3.0"}],"enisaIdVendor":[{"id":"8ba5fcf5-a8a8-37c5-a8b2-1659b0c13b3b","vendor":{"name":"@quasar"}},{"id":"b40d520a-0d8d-3705-9b99-a3d10f3de765","vendor":{"name":"quasarframework"}}],"enisaIdVulnerability":[{"id":"033ff933-88f9-3ad2-8fc2-dc01bacd179b","vulnerability":{"id":"GHSA-fh39-c73x-5pjv","description":"Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions","datePublished":"Oct 7, 2026, 4:16:18 PM","dateUpdated":"Oct 7, 2026, 4:16:18 PM","baseScore":0.0,"references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106105\nhttps://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575\nhttps://github.com/quasarframework/quasar\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4\n","enisa_id":"EUVD-2026-93570\n","aliases":"GHSA-fh39-c73x-5pjv\nCVE-2026-106105\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e44ec383-23ca-3d8c-baa6-b37b5dddfdb0","vulnerability":{"id":"CVE-2026-106105","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.","datePublished":"Oct 6, 2026, 5:20:36 PM","dateUpdated":"Oct 6, 2026, 5:53:57 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv\nhttps://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4\n","enisa_id":"EUVD-2026-93570\n","assigner":"GitHub_M","epss":0.07,"dataProcessed":"Nov 11, 2026, 7:21:49 AM","vulnerabilityProduct":[{"id":"2d9e6222-8bae-3c3e-a9db-f01a4896d810","product":{"name":"ssl-certificate","vendor":{"name":"@quasar"}},"product_version":"\u003c 2.1.0"},{"id":"70113c26-6a45-36ba-a91e-eed03d67a2e0","product":{"name":"app-vite","vendor":{"name":"@quasar"}},"product_version":"\u003c 3.3.0"},{"id":"70fc192d-c697-3a8d-ae0f-67ebdfb58e83","product":{"name":"cli","vendor":{"name":"cli"}},"product_version":"\u003c 5.0.4"},{"id":"a82ee3e4-9546-37ee-b813-abc569bfe151","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"\u003c 2.23.3"}],"vulnerabilityVendor":[{"id":"529c458d-e69b-3622-8095-2763249e8e3f","vendor":{"name":"quasarframework"}},{"id":"87dec4b2-ef67-3e14-9d62-eda2c134be0f","vendor":{"name":"@quasar"}}]}}],"enisaIdAdvisory":[]}