CVE-2026-106105
- Source
- https://cve.org/CVERecord?id=CVE-2026-106105
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106105.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-106105
- Aliases
- Published
- 2026-10-06T17:20:36Z
- Modified
- 2026-10-08T02:50:33Z
- Severity
-
- 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
- Details
-
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-732" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106105.json" }- References
-
- https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
- https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106105.json
- https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv
- https://nvd.nist.gov/vuln/detail/CVE-2026-106105
- https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575
Affected packages
Git / github.com/quasarframework/quasar
Affected ranges
- Type
- GIT
- Repo
- https://github.com/quasarframework/quasar
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "2.23.3" }, { "fixed": "3.3.0" }, { "fixed": "5.0.4" }, { "fixed": "2.1.0" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
@quasar/app-v1.*
@quasar/app-v1.0.0-beta.10
@quasar/app-v1.0.0-beta.11
@quasar/app-v1.0.0-beta.12
@quasar/app-v1.0.0-beta.13
@quasar/app-v1.0.0-beta.14
@quasar/app-v1.0.0-beta.15
@quasar/app-v1.0.0-beta.16
@quasar/app-v1.0.0-beta.17
@quasar/app-v1.0.0-beta.18
@quasar/app-v1.0.0-beta.19
@quasar/app-v1.0.0-beta.20
@quasar/app-v1.0.0-beta.21
@quasar/app-v1.0.0-beta.22
@quasar/app-v1.0.0-beta.23
@quasar/app-v1.0.0-beta.24
@quasar/app-v1.0.0-beta.25
@quasar/app-v1.0.0-beta.26
@quasar/app-v1.0.0-beta.8
@quasar/app-v1.0.0-beta.9
@quasar/app-v1.0.0-rc.1
@quasar/app-v1.0.0-rc.2
@quasar/app-v1.0.0-rc.3
@quasar/app-v1.0.0-rc.4
@quasar/app-v1.0.0-rc.5
@quasar/app-v1.0.0-rc.6
@quasar/app-v1.0.0-rc.7
@quasar/app-v1.0.1
@quasar/app-v1.0.2
@quasar/app-v1.0.3
@quasar/app-v1.0.4
@quasar/app-v1.0.5
@quasar/app-v1.0.6
@quasar/app-v1.1.0
@quasar/app-v1.1.1
@quasar/app-v1.1.2
@quasar/app-v1.1.3
@quasar/app-v1.1.4
@quasar/app-v1.2.0
@quasar/app-v1.2.1
@quasar/app-v1.2.2
@quasar/app-v1.2.3
@quasar/app-v1.2.4
@quasar/app-v1.3.0
@quasar/app-v1.3.1
@quasar/app-v1.3.2
@quasar/app-v1.3.3
@quasar/app-v1.3.4
@quasar/app-v1.3.5
@quasar/app-v1.3.6
@quasar/app-v1.3.7
@quasar/app-v1.4.0
@quasar/app-v1.4.1
@quasar/app-v1.4.2
@quasar/app-v1.4.3
@quasar/app-v1.4.4
@quasar/app-v1.4.5
@quasar/app-v1.5.0
@quasar/app-v1.5.1
@quasar/app-v1.5.2
@quasar/app-v1.5.3
@quasar/app-v1.5.4
@quasar/app-v1.5.5
@quasar/app-v1.5.6
@quasar/app-v1.5.7
@quasar/app-v1.5.8
@quasar/app-v1.6.0
@quasar/app-v1.6.1
@quasar/app-v1.6.2
@quasar/app-v1.7.0
@quasar/app-v1.7.1
@quasar/app-v1.7.2
@quasar/app-v1.7.3
@quasar/app-v1.7.4
@quasar/app-v1.8.2
@quasar/app-v1.8.4
@quasar/app-v1.8.5
@quasar/app-v1.8.6
@quasar/app-v1.8.7
@quasar/app-v1.8.8
@quasar/app-v1.8.9
@quasar/app-v1.9.1
@quasar/app-v1.9.2
@quasar/app-v1.9.4
@quasar/app-v1.9.5
@quasar/app-v1.9.6
@quasar/app-v2.*
@quasar/app-v2.0.0
@quasar/app-v2.0.1
@quasar/app-v2.0.2
@quasar/app-v2.0.3
@quasar/app-v2.0.4
@quasar/app-v2.0.5
@quasar/app-v2.0.6
@quasar/app-v2.1.1
@quasar/app-v2.1.13
@quasar/app-v2.1.14
@quasar/app-v2.1.15
@quasar/app-v2.1.2
@quasar/app-v2.1.3
@quasar/app-v2.1.5
@quasar/app-v2.1.7
@quasar/app-v2.1.8
@quasar/app-v2.2.0
@quasar/app-v2.2.1
@quasar/app-v2.2.10
@quasar/app-v2.2.2
@quasar/app-v2.2.4
@quasar/app-v2.2.5
@quasar/app-v2.2.6
@quasar/app-v2.2.8
@quasar/app-v3.*
@quasar/app-v3.0.0
@quasar/app-v3.0.1
@quasar/app-v3.0.2
@quasar/app-v3.0.3
@quasar/app-v3.0.4
@quasar/app-v3.1.0
@quasar/babel-preset-app-v1.*
@quasar/babel-preset-app-v1.0.1
@quasar/cli-v1.*
@quasar/cli-v1.0.0-beta.3
@quasar/cli-v1.0.0-beta.4
@quasar/cli-v1.0.0-beta.5
@quasar/cli-v1.0.0-beta.6
@quasar/cli-v1.0.0-beta.7
@quasar/cli-v1.0.0-rc.1
@quasar/cli-v1.0.0-rc.2
@quasar/cli-v1.0.1
@quasar/cli-v1.0.2
@quasar/cli-v1.0.3
@quasar/cli-v1.0.4
@quasar/cli-v1.0.5
@quasar/cli-v1.0.6
@quasar/cli-v1.0.7
@quasar/cli-v1.1.0
@quasar/cli-v1.1.1
@quasar/cli-v1.1.2
@quasar/extras-v1.*
@quasar/extras-v1.1.1
@quasar/extras-v1.1.2
@quasar/extras-v1.1.3
@quasar/extras-v1.1.4
@quasar/extras-v1.10.0
@quasar/extras-v1.10.1
@quasar/extras-v1.10.10
@quasar/extras-v1.10.11
@quasar/extras-v1.10.12
@quasar/extras-v1.10.2
@quasar/extras-v1.10.3
@quasar/extras-v1.10.4
@quasar/extras-v1.10.5
@quasar/extras-v1.10.6
@quasar/extras-v1.10.7
@quasar/extras-v1.10.8
@quasar/extras-v1.11.0
@quasar/extras-v1.2.0
@quasar/extras-v1.3.0
@quasar/extras-v1.3.2
@quasar/extras-v1.3.3
@quasar/extras-v1.4.0
@quasar/extras-v1.4.1
@quasar/extras-v1.4.2
@quasar/extras-v1.5.0
@quasar/extras-v1.5.1
@quasar/extras-v1.5.2
@quasar/extras-v1.6.0
@quasar/extras-v1.6.1
@quasar/extras-v1.6.2
@quasar/extras-v1.6.3
@quasar/extras-v1.7.0
@quasar/extras-v1.8.0
@quasar/extras-v1.8.1
@quasar/extras-v1.8.2
@quasar/extras-v1.9.0
@quasar/extras-v1.9.1
@quasar/extras-v1.9.10
@quasar/extras-v1.9.11
@quasar/extras-v1.9.11=2
@quasar/extras-v1.9.13
@quasar/extras-v1.9.14
@quasar/extras-v1.9.15
@quasar/extras-v1.9.16
@quasar/extras-v1.9.17
@quasar/extras-v1.9.18
@quasar/extras-v1.9.20
@quasar/extras-v1.9.4
@quasar/extras-v1.9.5
@quasar/extras-v1.9.6
@quasar/extras-v1.9.7
@quasar/extras-v1.9.8
@quasar/extras-v1.9.9
@quasar/icongenie-v2.*
@quasar/icongenie-v2.0.0
@quasar/icongenie-v2.0.1
@quasar/icongenie-v2.2.0
@quasar/icongenie-v2.3.0
@quasar/icongenie-v2.3.1
extras-v1.*
extras-v1.1.0
quasar-1.*
quasar-1.14.2
quasar-1.15.16
Other
quasar-v
quasar-v1.*
quasar-v1.0.0-beta.1
quasar-v1.0.0-beta.10
quasar-v1.0.0-beta.11
quasar-v1.0.0-beta.12
quasar-v1.0.0-beta.13
quasar-v1.0.0-beta.14
quasar-v1.0.0-beta.15
quasar-v1.0.0-beta.16
quasar-v1.0.0-beta.17
quasar-v1.0.0-beta.18
quasar-v1.0.0-beta.19
quasar-v1.0.0-beta.20
quasar-v1.0.0-beta.21
quasar-v1.0.0-beta.22
quasar-v1.0.0-beta.23
quasar-v1.0.0-beta.24
quasar-v1.0.0-beta.7
quasar-v1.0.0-beta.8
quasar-v1.0.0-beta.9
quasar-v1.0.0-rc.2
quasar-v1.0.0-rc.3
quasar-v1.0.0-rc.4
quasar-v1.0.0-rc.5
quasar-v1.0.3
quasar-v1.0.4
quasar-v1.0.5
quasar-v1.1.0
quasar-v1.1.1
quasar-v1.1.2
quasar-v1.1.3
quasar-v1.1.4
quasar-v1.1.5
quasar-v1.1.6
quasar-v1.1.7
quasar-v1.10.1
quasar-v1.10.2
quasar-v1.10.3
quasar-v1.10.4
quasar-v1.10.5
quasar-v1.11.0
quasar-v1.11.1
quasar-v1.11.2
quasar-v1.11.3
quasar-v1.12.1
quasar-v1.12.10
quasar-v1.12.11
quasar-v1.12.12
quasar-v1.12.13
quasar-v1.12.3
quasar-v1.12.4
quasar-v1.12.5
quasar-v1.12.6
quasar-v1.12.7
quasar-v1.12.8
quasar-v1.12.9
quasar-v1.14.1
quasar-v1.14.4
quasar-v1.14.5
quasar-v1.15.0
quasar-v1.15.1
quasar-v1.15.10
quasar-v1.15.11
quasar-v1.15.12
quasar-v1.15.13
quasar-v1.15.14
quasar-v1.15.15
quasar-v1.15.19
quasar-v1.15.21
quasar-v1.15.4
quasar-v1.15.5
quasar-v1.15.6
quasar-v1.15.9
quasar-v1.2.0
quasar-v1.2.1
quasar-v1.2.2
quasar-v1.2.3
quasar-v1.2.4
quasar-v1.2.5
quasar-v1.2.6
quasar-v1.2.7
quasar-v1.3.0
quasar-v1.4.0
quasar-v1.4.1
quasar-v1.4.2
quasar-v1.4.4
quasar-v1.4.5
quasar-v1.5.0
quasar-v1.5.1
quasar-v1.5.10
quasar-v1.5.11
quasar-v1.5.2
quasar-v1.5.3
quasar-v1.5.4
quasar-v1.5.5
quasar-v1.5.6
quasar-v1.5.7
quasar-v1.5.8
quasar-v1.5.9
quasar-v1.6.0
quasar-v1.6.1
quasar-v1.7.0
quasar-v1.7.1
quasar-v1.7.2
quasar-v1.7.3
quasar-v1.7.4
quasar-v1.8.0
quasar-v1.8.1
quasar-v1.8.2
quasar-v1.8.3
quasar-v1.8.4
quasar-v1.8.5
quasar-v1.9.0
quasar-v1.9.1
quasar-v1.9.10
quasar-v1.9.11
quasar-v1.9.12
quasar-v1.9.13
quasar-v1.9.14
quasar-v1.9.15
quasar-v1.9.16
quasar-v1.9.2
quasar-v1.9.3
quasar-v1.9.4
quasar-v1.9.5
quasar-v1.9.6
quasar-v1.9.7
quasar-v1.9.8
quasar-v1.9.9
quasar-v2.*
quasar-v2.0.0
quasar-v2.0.1
quasar-v2.0.2
quasar-v2.0.3
quasar-v2.0.4
v0.*
v0.10
v0.10.1
v0.10.2
v0.10.3
v0.11
v0.12.0
v0.13.0
v0.13.1
v0.13.2
v0.13.3
v0.13.4
v0.13.5
v0.13.6
v0.14.1
v0.14.2
v0.14.5
v0.15.0
v0.15.1
v0.15.10
v0.15.11
v0.15.12
v0.15.13
v0.15.15
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.15.6
v0.15.7
v0.15.8
v0.15.9
v0.16.0
v0.17.0
v0.17.1
v0.17.10
v0.17.11
v0.17.12
v0.17.13
v0.17.14
v0.17.15
v0.17.16
v0.17.17
v0.17.18
v0.17.19
v0.17.2
v0.17.3
v0.17.4
v0.17.5
v0.17.6
v0.17.7
v0.17.8
v0.17.9
v0.4.1
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.1
v1.*
v1.0.0
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.15.8