CVE-2026-106105: CWE-732: Incorrect Permission Assignment for Critical Resource in quasarframework quasar

The vulnerability CVE-2026-106105 affects the Quasar Framework's @quasar/ssl-certificate utility and related packages. Prior to the fixed versions, the utility cached a combined private key and certificate PEM file without enforcing owner-only filesystem permissions. This misconfiguration allows any local user with read access to the cache to copy the private key and impersonate a development TLS endpoint in environments that trust the certificate. Additionally, the generated certificates were CA-capable with unnecessarily broad key usages and included the IPv6 loopback address as a DNS subject alternative name, which may increase risk. The issue is resolved by updating to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.

Local users with read access to the cached private key and certificate can impersonate development TLS endpoints, potentially undermining TLS security in trusted environments. The CA-capable certificates with broad key usages increase the risk of misuse. This vulnerability compromises the confidentiality and integrity of development TLS communications.

This vulnerability is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0. Users should upgrade to these versions or later to ensure proper permission assignment on cached certificates and keys and to avoid the risks associated with the flawed certificate generation. No additional mitigations are indicated by the vendor advisory.