CVE-2026-106105: Quasar @quasar/ssl-certificate: Development TLS private key cached with insecure permissions

Summary

The @quasar/ssl-certificate utility, used by Quasar CLI tooling to create localhost development HTTPS certificates, cached the private key and certificate together without restricting file permissions. A other local user who can read the cache file can copy the key and impersonate the development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable and had overly broad key usages.

Affected

@quasar/ssl-certificate before 2.1.0
@quasar/cli before 5.0.4
@quasar/app-vite before 3.3.0
Quasar Framework (quasarframework/quasar) before 2.23.3 according to aggregator data, not confirmed in a primary Quasar source

Fixed in

@quasar/ssl-certificate 2.1.0
@quasar/cli 5.0.4
@quasar/app-vite 3.3.0

Workaround

Unknown.

Interim measures (not from the vendor advisory): delete cached Quasar development certificates and keys from developer home directories, check that the cache file is readable only by its owner, and remove trust-store entries for the development certificate.

Exploitation

CISA SSVC: exploitation none, not automatable.
Not listed in CISA KEV.
No public proof of concept or in-the-wild exploitation found in the sources reviewed.

Our recommendation

Update @quasar/ssl-certificate to 2.1.0 or later, @quasar/cli to 5.0.4 or later, and @quasar/app-vite to 3.3.0 or later; pin the versions rather than using loose ranges such as ^2.0.0.
Rebuild lockfiles and check transitive dependencies.
Delete existing development certificates and keys from the cache, then regenerate them after the upgrade.
Remove trust-store entries for old development certificates.
Prioritise shared developer workstations, build servers and CI runners where other local accounts exist.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

GitHub Security Advisory GHSA-fh39-c73x-5pjv github.com
Fix commit b719460 github.com
Release @quasar/app-vite v3.3.0 github.com
Release @quasar/cli v5.0.4 github.com
OSV entry CVE-2026-106105 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:47.

Original description (NVD)

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed