Is CVE-2026-106105 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106105 being exploited in the wild.

How severe is CVE-2026-106105?

High severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

@quasar/app-vite (npm) <= 3.2.0, SEMVER:introduced=0,fixed=3.3.0; @quasar/cli (npm) <= 5.0.3, SEMVER:introduced=0,fixed=5.0.4; @quasar/ssl-certificate (npm) <= 2.0.0, SEMVER:introduced=0,fixed=2.1.0; Quasar @Quasar/App-Vite prior to 3.3.0; and 2 more.

Is there a fix for CVE-2026-106105?

Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/cli (npm): upgrade to 5.0.4 or later; @quasar/ssl-certificate (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106105 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-106105?

Check whether you run @quasar/app-vite (npm), @quasar/cli (npm), @quasar/ssl-certificate (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106105: Quasar Framework SSL certificate cache permissions vulnerability

Q: Is there a fix for CVE-2026-106105?

Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/cli (npm): upgrade to 5.0.4 or later; @quasar/ssl-certificate (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106105 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-106105?

Check whether you run @quasar/app-vite (npm), @quasar/cli (npm), @quasar/ssl-certificate (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106105 · Severity: high · CVSS 4 · Published 2026-10-06

Quasar Framework is a tool for building Vue.js web applications that developers use during local development. The framework cached development TLS certificates and private keys with world-readable permissions, allowing other local users to copy them and impersonate development servers. An attacker with local access could steal credentials and perform man-in-the-middle attacks against development environments that trust the certificate.

Technologies: @quasar/app-vite (npm), Quasar @Quasar/App-Vite. Vendors: npm, Quasar.

Quick answers

Is CVE-2026-106105 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106105 being exploited in the wild.
How severe is CVE-2026-106105?: High severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: @quasar/app-vite (npm) <= 3.2.0, SEMVER:introduced=0,fixed=3.3.0; @quasar/cli (npm) <= 5.0.3, SEMVER:introduced=0,fixed=5.0.4; @quasar/ssl-certificate (npm) <= 2.0.0, SEMVER:introduced=0,fixed=2.1.0; Quasar @Quasar/App-Vite prior to 3.3.0; and 2 more.
Is there a fix for CVE-2026-106105?: Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later; @quasar/cli (npm): upgrade to 5.0.4 or later; @quasar/ssl-certificate (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106105 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-106105?: Check whether you run @quasar/app-vite (npm), @quasar/cli (npm), @quasar/ssl-certificate (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@quasar/app-vite (npm): upgrade to 3.3.0 or later
```
npm install @quasar/app-vite@3.3.0
```
@quasar/cli (npm): upgrade to 5.0.4 or later
```
npm install @quasar/cli@5.0.4
```
@quasar/ssl-certificate (npm): upgrade to 2.1.0 or later
```
npm install @quasar/ssl-certificate@2.1.0
```

Technical details

The @quasar/ssl-certificate utility cached a combined private key and certificate in PEM format without setting owner-only filesystem permissions (mode 0600), allowing local users to read the material via the cache directory. The generated certificate was also CA-capable with overly broad key usages and included the IPv6 loopback address as a DNS SAN. An attacker with local system access can read the cache, extract the private key, and impersonate the development TLS endpoint in environments trusting that certificate.

Affected products

Quasar @quasar/ssl-certificate prior to 2.1.0
Quasar @quasar/cli prior to 5.0.4
Quasar @quasar/app-vite prior to 3.3.0

Identifiers

CVE-2026-106105
GHSA-fh39-c73x-5pjv

Timeline

2026-07-29: patched: Fixes released in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0
2026-10-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.