Icongenie
Monthly
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.