npm/@quasar/cli CVE-2026-106105: high 8.4, EPSS 0.07%

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Action: Upgrade @quasar/cli to 5.0.4 or later.

npm i @quasar/cli@5.0.4

Affected

Fixed versions

Sources

• osv: GHSA-fh39-c73x-5pjv#npm/@quasar/cli
• nvd: CVE-2026-106105
• https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv
• https://github.com/quasarframework/quasar/commit/b719460aa78e88714b8a1b7ca68267234d217575
• https://github.com/quasarframework/quasar
• https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
• https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4

CVE-2026-106105 · published 2026-10-07T16:16:18Z · modified 2026-10-07T16:30:05.797363242Z · JSON