CVE-2026-106105 Quasar Framework CVE debrief

Who should care

Defenders responsible for development environments using the Quasar Framework should assess exposure and prioritize remediation. They should verify the cached PEM file permissions, review the certificate configuration, and assess the impact on development environments. The vulnerability allows local attackers to potentially read and reuse private keys due to overly permissive filesystem permissions in the Quasar Framework's development utility.

Why it matters

CVE-2026-106105 allows local attackers to potentially read and reuse private keys due to overly permissive filesystem permissions in the Quasar Framework's development utility. Defenders should verify and remediate this vulnerability in development environments.

• Local attackers may impersonate development TLS endpoints
• Private key exposure may allow unauthorized access
• Certificate misconfiguration may enable unnecessary CA capabilities
• Filesystem permission weaknesses require verification and remediation

Technical summary

The `@quasar/ssl-certificate` development utility in the Quasar Framework generates a private key and certificate with overly permissive filesystem permissions. A local attacker could read and reuse the private key to impersonate a development TLS endpoint. The certificate is unnecessarily CA-capable with broad key usages. The remediation involves restricting PEM permissions, generating a non-CA server-auth leaf certificate, correcting the IPv6 loopback SAN, and basing cache expiry on content modification time. Defenders should prioritize verifying and remediating this vulnerability in development environments, especially where multiple local users have filesystem access.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in development environments, especially where multiple local users have filesystem access.

Recommended defensive actions

• Verify and restrict access to the cached PEM file
• Update to version 2.1.0 or later of @quasar/ssl-certificate
• Update to version 5.0.4 or later of @quasar/cli
• Update to version 3.3.0 or later of @quasar/app-vite
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The source item (GHSA-fh39-c73x-5pjv) and CVE Program record provide details on the vulnerability. The NVD entry is currently being processed. Defenders should verify the cached PEM file permissions, review the certificate configuration, and assess the impact on development environments. The vulnerability allows local attackers to potentially read and reuse private keys due to overly permissive filesystem permissions in the Quasar Framework's development utility.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.