GHSA-WMPW-J6QV-MW88 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Vulnerability Details File: icongenie/lib/utils/get-assets-files.js line 35, absoluteName: joinappDir, asset.folder, asset.name Validation gap: icongenie/lib/utils/validate-profile-object.js assetsSchema — folder/name only checked with Joi.string.required.min1, no restriction on .. sequences or...

EUVD-2026-93568

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile...

CVE-2026-106103

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

@mythpe/js-helpers (>=2.0.2, <=2.0.9) potentially affected by CVE-2026-106103 via @quasar/icongenie (2.5.4)

@quasar/icongenie NPM version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on @quasar/icongenie and may be impacted: - @mythpe/js-helpers =2.0.2, =2.0.9 Source cves: CVE-2026-106103 Source advisory: MEND:CVE-2026-106103...

CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103

The Quasar Framework is vulnerable to a Path Traversal and Arbitrary File Write vulnerability in the @quasar/icongenie component prior to version 6.1.1 . The root cause is located in icongenie/lib/utils/get-assets-files.js and icongenie/lib/utils/validate-profile-object.js, where the icongenie ge...

PT-2026-106821

Name of the Vulnerable Software and Affected Versions @quasar/icongenie versions prior to 6.1.1 Description The icongenie generate --profile command fails to constrain the resolved destination to the Quasar project directory when processing folder and name values from a user-supplied profile. The...

CVE-2026-106103: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...