{"id":"CVE-2026-106105","summary":"Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions","details":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.","aliases":["GHSA-fh39-c73x-5pjv"],"modified":"2026-10-08T02:50:33.416543585Z","published":"2026-10-06T17:20:36.923Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-732"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106105.json"},"references":[{"type":"WEB","url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"},{"type":"WEB","url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106105.json"},{"type":"ADVISORY","url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106105"},{"type":"FIX","url":"https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/quasarframework/quasar","events":[{"introduced":"0"},{"fixed":"db082a4407936be7865c7c85dd1862bb213f0c08"},{"fixed":"605f4da74c54bd3c3f3a22350396ca8c1ee0e084"},{"fixed":"4760999036926cec26ef64f6b90839d282e5b0a3"},{"fixed":"14a8d0b744d9454c2ab447bfc349040c65b36da8"},{"fixed":"b719460aa78e88714b8a1b7ca68267234d217575"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.23.3"},{"fixed":"3.3.0"},{"fixed":"5.0.4"},{"fixed":"2.1.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["@quasar/extras-v1.11.0","@quasar/extras-v1.10.12","quasar-v2.0.4","@quasar/app-v3.1.0","@quasar/extras-v1.10.11","@quasar/extras-v1.10.10","@quasar/app-v3.0.4","quasar-v2.0.3","@quasar/app-v3.0.3","quasar-v2.0.2","@quasar/app-v3.0.2","@quasar/extras-v1.10.8","quasar-v2.0.1","@quasar/app-v3.0.1","quasar-v2.0.0","@quasar/app-v3.0.0","quasar-v1.15.21","@quasar/extras-v1.10.7","@quasar/app-v2.2.10","@quasar/extras-v1.10.6","quasar-v1.15.19","@quasar/app-v2.2.8","quasar-1.15.16","@quasar/extras-v1.10.5","quasar-v1.15.15","quasar-v1.15.14","quasar-v1.15.13","@quasar/app-v2.2.6","quasar-v1.15.12","quasar-v1.15.11","@quasar/app-v2.2.5","@quasar/extras-v1.10.4","@quasar/extras-v1.10.3","quasar-v1.15.10","@quasar/app-v2.2.4","@quasar/extras-v1.10.2","@quasar/extras-v1.10.1","quasar-v1.15.9","v1.15.8","@quasar/extras-v1.10.0","@quasar/extras-v1.9.20","quasar-v1.15.6","@quasar/app-v2.2.2","@quasar/app-v2.2.1","quasar-v1.15.5","@quasar/app-v2.2.0","@quasar/extras-v1.9.18","quasar-v1.15.4","@quasar/app-v2.1.15","@quasar/extras-v1.9.17","@quasar/extras-v1.9.16","@quasar/extras-v1.9.15","quasar-v1.15.1","@quasar/extras-v1.9.14","@quasar/extras-v1.9.13","quasar-v1.15.0","@quasar/app-v2.1.14","@quasar/app-v2.1.13","@quasar/extras-v1.9.11=2","@quasar/extras-v1.9.11","@quasar/app-v2.1.8","quasar-v1.14.5","quasar-v1.14.4","@quasar/app-v2.1.7","@quasar/extras-v1.9.10","@quasar/app-v2.1.5","@quasar/app-v2.1.3","quasar-1.14.2","@quasar/app-v2.1.2","@quasar/extras-v1.9.9","@quasar/extras-v1.9.8","quasar-v1.14.1","@quasar/app-v2.1.1","@quasar/cli-v1.1.2","@quasar/cli-v1.1.1","@quasar/extras-v1.9.7","@quasar/extras-v1.9.6","@quasar/extras-v1.9.5","@quasar/extras-v1.9.4","@quasar/extras-v1.9.1","quasar-v1.12.13","@quasar/extras-v1.9.0","@quasar/icongenie-v2.3.1","@quasar/app-v2.0.6","quasar-v1.12.12","@quasar/app-v2.0.5","quasar-v1.12.11","quasar-v1.12.10","@quasar/app-v2.0.4","quasar-v1.12.9","@quasar/app-v2.0.3","@quasar/app-v2.0.2","@quasar/app-v2.0.1","quasar-v1.12.8","@quasar/cli-v1.1.0","quasar-v1.12.7","quasar-v1.12.6","@quasar/app-v2.0.0","@quasar/icongenie-v2.3.0","quasar-v1.12.5","quasar-v1.12.4","@quasar/extras-v1.8.2","quasar-v1.12.3","@quasar/app-v1.9.6","@quasar/app-v1.9.5","@quasar/app-v1.9.4","quasar-v1.12.1","@quasar/app-v1.9.2","@quasar/app-v1.9.1","@quasar/app-v1.8.9","@quasar/app-v1.8.8","@quasar/app-v1.8.7","quasar-v1.11.3","quasar-v1.11.2","@quasar/extras-v1.8.1","quasar-v1.11.1","quasar-v1.11.0","@quasar/extras-v1.8.0","@quasar/app-v1.8.6","@quasar/app-v1.8.5","quasar-v1.10.5","@quasar/icongenie-v2.2.0","quasar-v1.10.4","quasar-v1.10.3","quasar-v1.10.2","quasar-v1.10.1","@quasar/app-v1.8.4","@quasar/app-v1.8.2","@quasar/extras-v1.7.0","@quasar/app-v1.7.4","@quasar/app-v1.7.3","@quasar/icongenie-v2.0.1","@quasar/icongenie-v2.0.0","quasar-v1.9.16","@quasar/app-v1.7.2","@quasar/cli-v1.0.7","quasar-v1.9.15","@quasar/app-v1.7.1","@quasar/app-v1.7.0","@quasar/cli-v1.0.6","@quasar/extras-v1.6.3","@quasar/app-v1.6.2","quasar-v1.9.14","@quasar/extras-v1.6.2","quasar-v1.9.13","@quasar/app-v1.6.1","@quasar/extras-v1.6.1","quasar-v1.9.12","quasar-v1.9.11","quasar-v1.9.10","quasar-v1.9.9","@quasar/extras-v1.6.0","quasar-v1.9.8","quasar-v1.9.7","quasar-v1.9.6","quasar-v1.9.5","@quasar/app-v1.6.0","quasar-v1.9.4","@quasar/extras-v1.5.2","quasar-v1.9.3","@quasar/app-v1.5.8","@quasar/app-v1.5.7","@quasar/app-v1.5.6","quasar-v1.9.2","quasar-v1.9.1","@quasar/app-v1.5.5","quasar-v1.9.0","@quasar/app-v1.5.4","@quasar/extras-v1.5.1","@quasar/app-v1.5.3","quasar-v1.8.5","quasar-v1.8.4","quasar-v1.8.3","quasar-v1.8.2","quasar-v1.8.1","quasar-v1.8.0","@quasar/extras-v1.5.0","@quasar/app-v1.5.2","quasar-v1.7.4","@quasar/extras-v1.4.2","quasar-v1.7.3","quasar-v1.7.2","@quasar/app-v1.5.1","@quasar/extras-v1.4.1","@quasar/app-v1.5.0","quasar-v1.7.1","quasar-v1.7.0","@quasar/app-v1.4.5","@quasar/extras-v1.4.0","@quasar/app-v1.4.4","quasar-v1.6.1","quasar-v1.6.0","quasar-v1.5.11","quasar-v1.5.10","@quasar/app-v1.4.3","@quasar/cli-v1.0.5","@quasar/cli-v1.0.4","@quasar/app-v1.4.2","@quasar/app-v1.4.1","quasar-v1.5.9","@quasar/app-v1.4.0","@quasar/app-v1.3.7","quasar-v1.5.8","@quasar/app-v1.3.6","@quasar/app-v1.3.5","quasar-v1.5.7","quasar-v1.5.6","@quasar/app-v1.3.4","quasar-v1.5.5","@quasar/app-v1.3.3","quasar-v1.5.4","@quasar/app-v1.3.2","quasar-v1.5.3","quasar-v1.5.2","quasar-v1.5.1","quasar-v1.5.0","@quasar/app-v1.3.1","@quasar/app-v1.3.0","@quasar/cli-v1.0.3","quasar-v1.4.5","quasar-v1.4.4","@quasar/app-v1.2.4","quasar-v1.4.2","quasar-v1.4.1","@quasar/cli-v1.0.2","@quasar/cli-v1.0.1","@quasar/extras-v1.3.3","quasar-v1.4.0","quasar-v1.3.0","@quasar/app-v1.2.3","quasar-v1.2.7","quasar-v1.2.6","quasar-v1.2.5","quasar-v1.2.4","quasar-v1.2.3","@quasar/app-v1.2.2","quasar-v1.2.2","quasar-v1.2.1","@quasar/app-v1.2.1","@quasar/app-v1.2.0","quasar-v1.2.0","quasar-v1.1.7","@quasar/app-v1.1.4","@quasar/app-v1.1.3","quasar-v1.1.6","quasar-v1.1.5","quasar-v1.1.4","@quasar/extras-v1.3.2","quasar-v1.1.3","@quasar/app-v1.1.2","@quasar/app-v1.1.1","quasar-v1.1.2","@quasar/app-v1.1.0","quasar-v1.1.1","@quasar/app-v1.0.6","quasar-v1.1.0","@quasar/app-v1.0.5","@quasar/extras-v1.3.0","quasar-v1.0.5","@quasar/extras-v1.2.0","@quasar/app-v1.0.4","quasar-v1.0.4","@quasar/app-v1.0.3","@quasar/app-v1.0.2","quasar-v1.0.3","@quasar/app-v1.0.1","v1.0.0","@quasar/extras-v1.1.4","quasar-v1.0.0-rc.5","@quasar/app-v1.0.0-rc.7","@quasar/extras-v1.1.3","@quasar/app-v1.0.0-rc.6","quasar-v1.0.0-rc.4","@quasar/app-v1.0.0-rc.5","quasar-v1.0.0-rc.3","@quasar/app-v1.0.0-rc.4","@quasar/app-v1.0.0-rc.3","@quasar/app-v1.0.0-rc.2","@quasar/cli-v1.0.0-rc.2","quasar-v1.0.0-rc.2","@quasar/app-v1.0.0-rc.1","@quasar/cli-v1.0.0-rc.1","quasar-v1.0.0-beta.24","@quasar/app-v1.0.0-beta.26","@quasar/app-v1.0.0-beta.25","@quasar/app-v1.0.0-beta.24","quasar-v1.0.0-beta.23","@quasar/app-v1.0.0-beta.23","quasar-v1.0.0-beta.22","quasar-v1.0.0-beta.21","@quasar/cli-v1.0.0-beta.7","@quasar/extras-v1.1.2","@quasar/app-v1.0.0-beta.22","quasar-v1.0.0-beta.20","@quasar/app-v1.0.0-beta.21","@quasar/cli-v1.0.0-beta.6","@quasar/cli-v1.0.0-beta.5","quasar-v1.0.0-beta.19","@quasar/app-v1.0.0-beta.20","quasar-v1.0.0-beta.18","@quasar/app-v1.0.0-beta.19","@quasar/app-v1.0.0-beta.18","quasar-v1.0.0-beta.17","@quasar/app-v1.0.0-beta.17","quasar-v1.0.0-beta.16","@quasar/app-v1.0.0-beta.16","quasar-v1.0.0-beta.15","quasar-v1.0.0-beta.14","@quasar/app-v1.0.0-beta.15","@quasar/cli-v1.0.0-beta.4","@quasar/app-v1.0.0-beta.14","quasar-v1.0.0-beta.13","quasar-v1.0.0-beta.12","@quasar/app-v1.0.0-beta.13","@quasar/extras-v1.1.1","quasar-v1.0.0-beta.11","quasar-v","@quasar/app-v1.0.0-beta.12","quasar-v1.0.0-beta.10","@quasar/cli-v1.0.0-beta.3","@quasar/app-v1.0.0-beta.11","quasar-v1.0.0-beta.9","@quasar/app-v1.0.0-beta.10","quasar-v1.0.0-beta.8","quasar-v1.0.0-beta.7","v1.0.0-beta.6","v1.0.0-beta.5","@quasar/app-v1.0.0-beta.9","@quasar/app-v1.0.0-beta.8","extras-v1.1.0","@quasar/babel-preset-app-v1.0.1","v1.0.0-beta.4","v1.0.0-beta.3","v1.0.0-beta.2","quasar-v1.0.0-beta.1","v0.17.19","v0.17.18","v0.17.17","v0.17.16","v0.17.15","v0.17.14","v0.17.13","v0.17.12","v0.17.11","v0.17.10","v0.17.9","v0.17.8","v0.17.7","v0.17.6","v0.17.5","v0.17.4","v0.17.3","v0.17.2","v0.17.1","v0.17.0","v0.16.0","v0.15.15","v0.15.13","v0.15.12","v0.15.11","v0.15.10","v0.15.9","v0.15.8","v0.15.7","v0.15.6","v0.15.5","v0.15.4","v0.15.3","v0.15.2","v0.15.1","v0.15.0","v0.14.5","v0.14.2","v0.14.1","v0.13.6","v0.13.5","v0.13.4","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.0","v0.11","v0.10.3","v0.10.2","v0.10.1","v0.10","v0.9.1","v0.8.2","v0.8.1","v0.8.0","v0.7.0","v0.6.0","v0.5.0","v0.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106105.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}