# CVE-2026-106103: Quasar icongenie path traversal in generate command

Source: https://junglewise.ai/threats/cve-2026-106103-quasar-framework-is-a-framework-for-building-high-performance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106103 · Severity: high · CVSS 7.1 · Published 2026-10-06

Quasar icongenie is a tool for generating application icons from profiles. A developer using a crafted profile could cause the tool to write files outside the intended project directory, potentially modifying shell startup files or build scripts that would execute with the developer's privileges.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Quasar](https://junglewise.ai/threats/vendors/quasar).

## Quick answers

**Is CVE-2026-106103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106103 being exploited in the wild.

**How severe is CVE-2026-106103?** High severity, with a CVSS score of 7.1, published 6 October 2026.

**Which products and versions are affected?** @quasar/icongenie (npm) < 6.1.1, SEMVER:introduced=0,fixed=6.1.1; Quasar Icongenie before 6.1.1.

**Is there a fix for CVE-2026-106103?** Yes. @quasar/icongenie (npm): upgrade to 6.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106103 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-106103?** Check whether you run @quasar/icongenie (npm) or Quasar Icongenie at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @quasar/icongenie (npm): upgrade to 6.1.1 or later

  ```sh
  npm install @quasar/icongenie@6.1.1
  ```


## Technical details

The icongenie generate --profile command fails to constrain the destination path when processing user-supplied folder and name values from a profile. By traversing parent directories, an attacker can write or overwrite files at arbitrary locations writable by the developer running the command. The vulnerability stems from insufficient path validation in get-assets-files.js and validate-profile-object.js.

## Affected products

- Quasar icongenie before 6.1.1

## Identifiers

- CVE-2026-106103
- GHSA-wmpw-j6qv-mw88

## Timeline

- 2026-10-06: disclosed

## References

- [https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3](https://github.com/quasarframework/quasar/commit/87c89a80ec84f1eb7dbe258e5367161b0598ceb3)
- [https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1](https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1)