EUVD-2026-93568
GHSA-wmpw-j6qv-mw88
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Local because exploitation runs through the icongenie CLI (AV:L); UI:R since a developer must run it on a crafted profile; file overwrite gives I:H/A:H with no read, so C:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.
AnalysisAI
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that a developer execute the `icongenie generate --profile` command against an attacker-controlled profile file; exploitation is impossible without that developer action (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, developer-targeted supply-chain-style risk rather than a mass-exploitation threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @quasar/icongenie to 6.1.1 or later (https://github.com/quasarframework/quasar/releases/tag/@quasar/icongenie-v6.1.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all repositories, CI/CD pipelines, and developer workstations that depend on @quasar/icongenie, confirm the installed versions, and instruct developers not to run 'icongenie generate --profile' against any profile file they did not author or review; treat profile files from tickets, pull requests, or third parties as untrusted input. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today