{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "@quasar ssl-certificate: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/quasar--ssl-certificate/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/quasar--ssl-certificate/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106105/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106105/",
   "title": "CVE-2026-106105 disclosed",
   "content_text": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.",
   "date_published": "2026-10-06T17:20:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106105/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106105/",
   "title": "CVE-2026-106105 fixed upstream (npm)",
   "content_text": "Fixed versions: @quasar/app-vite 3.3.0, @quasar/cli 5.0.4, @quasar/ssl-certificate 2.1.0.",
   "date_published": "2026-10-06T17:20:36Z"
  }
 ]
}