Is CVE-2026-106103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106103 being exploited in the wild.

How severe is CVE-2026-106103?

High severity, with a CVSS score of 7.1, published 6 October 2026.

Which products and versions are affected?

@quasar/icongenie (npm) < 6.1.1, SEMVER:introduced=0,fixed=6.1.1; Quasar Icongenie before 6.1.1.

Is there a fix for CVE-2026-106103?

Yes. @quasar/icongenie (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106103 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-106103?

Check whether you run @quasar/icongenie (npm) or Quasar Icongenie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106103: Quasar icongenie path traversal in generate command

Q: Is there a fix for CVE-2026-106103?

Yes. @quasar/icongenie (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106103 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-106103?

Check whether you run @quasar/icongenie (npm) or Quasar Icongenie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106103 · Severity: high · CVSS 7.1 · Published 2026-10-06

Quasar icongenie is a tool for generating application icons from profiles. A developer using a crafted profile could cause the tool to write files outside the intended project directory, potentially modifying shell startup files or build scripts that would execute with the developer's privileges.

Vendors: npm, Quasar.

Quick answers

Is CVE-2026-106103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106103 being exploited in the wild.
How severe is CVE-2026-106103?: High severity, with a CVSS score of 7.1, published 6 October 2026.
Which products and versions are affected?: @quasar/icongenie (npm) < 6.1.1, SEMVER:introduced=0,fixed=6.1.1; Quasar Icongenie before 6.1.1.
Is there a fix for CVE-2026-106103?: Yes. @quasar/icongenie (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106103 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-106103?: Check whether you run @quasar/icongenie (npm) or Quasar Icongenie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@quasar/icongenie (npm): upgrade to 6.1.1 or later
```
npm install @quasar/icongenie@6.1.1
```

Technical details

The icongenie generate --profile command fails to constrain the destination path when processing user-supplied folder and name values from a profile. By traversing parent directories, an attacker can write or overwrite files at arbitrary locations writable by the developer running the command. The vulnerability stems from insufficient path validation in get-assets-files.js and validate-profile-object.js.

Affected products

Quasar icongenie before 6.1.1

Identifiers

CVE-2026-106103
GHSA-wmpw-j6qv-mw88

Timeline

2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.