CVE-2026-106105 Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
Local attackers can read cached TLS private keys due to permissive file permissions, allowing them to impersonate development endpoints.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106105?
CVE-2026-106105 is a high-severity vulnerability in @quasar app-vite, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
Weakness: CWE-732
Which versions are affected by CVE-2026-106105?
6 open source packages ship an affected version, including @quasar/app-vite, @quasar/cli and @quasar/ssl-certificate.
| Package | Affected | Fixed in |
|---|---|---|
@quasar/app-vite npm | All versions | 3.3.0 |
@quasar/app-vite npm | All versions | 3.3.0 |
@quasar/cli npm | All versions | 5.0.4 |
@quasar/cli npm | All versions | 5.0.4 |
@quasar/ssl-certificate npm | All versions | 2.1.0 |
@quasar/ssl-certificate npm | All versions | 2.1.0 |
How do I fix CVE-2026-106105?
Upgrade @quasar/app-vite to 3.3.0 or later.
Is CVE-2026-106105 being exploited?
There is no known exploitation of CVE-2026-106105 in the wild and no public exploit code.
Sources
Also known as GHSA-fh39-c73x-5pjv.