EUVD-2026-93570
GHSA-fh39-c73x-5pjv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file read by a separate unprivileged user (AV:L, PR:L, AC:L, UI:N); high confidentiality from key theft and high integrity from TLS impersonation; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 npm packages depend on @quasar/ssl-certificate (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.1.0.
DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.
AnalysisAI
Insecure file permissions in Quasar's development TLS certificate utility (@quasar/ssl-certificate before 2.1.0, shipped via @quasar/cli before 5.0.4 and @quasar/app-vite before 3.3.0) let another local, unprivileged user on the same host read the cached combined private key and certificate PEM and then impersonate the developer's localhost HTTPS endpoint in any environment that trusts that certificate. The flaw is a local, low-privilege information-disclosure and impersonation issue (CWE-732) rather than a remotely exploitable critical condition: it only matters on multi-user, non-Windows machines (shared workstations, CI/build servers, container hosts) where at least one other local account exists and the generated dev certificate is actually trusted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a multi-user environment where at least one other local, unprivileged user account exists on the same host as the developer running the Quasar dev server (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a local, low-privilege information-disclosure/impersonation flaw (CWE-732, insecure file permissions) rather than a remotely exploitable critical issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4 and @quasar/app-vite 3.3.0 (or later); the releases are tagged at https://github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4 and https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0, and the advisory is https://github.com/quasarframework/quasar/security/advisories/GHSA-fh39-c73x-5pjv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify any systems using @quasar/ssl-certificate before 2.1.0, @quasar/cli before 5.0.4, or @quasar/app-vite before 3.3.0 and restrict permissions on cached TLS private key and certificate PEM files (e.g., 0600) to the owning user; remove or relocate cached dev certificates from shared directories, and stop trusting generated Quasar dev certificates on multi-user non-Windows workstations, CI/build servers, and container hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Rated h
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH serve
go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. Rated high severity
Symlink-following vulnerabilities in Capgo CLI before version 12.128.2 (npm @capgo/cli < 7.84.6) allow an attacker who c
Capgo CLI's Android onboarding flow silently grants the Google Play service account it generates the account-wide Play C
Command execution via URI injection in GitHub CLI's `gh codespace jupyter` subcommand (versions 2.10.0-2.95.0) allows an
The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands, aka
Terminal escape sequence injection in GitHub CLI 1.6.0 through 2.91.x allows authenticated attackers with pull request c
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. Rated low severity (CVSS 2.6), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today