AIKIDO-2026-625157
@quasar/app-vite is vulnerable to Incorrect Permission Assignment for Critical Resource
55
Medium Risk
This Affects:
@quasar/app-viteTL;DR
The development TLS helper used by @quasar/app-vite caches a combined PEM containing a generated private key and certificate without restricting its filesystem permissions. Under a typical process umask the file can be readable by other local users, allowing a co-located user to copy the private key and impersonate a development TLS endpoint that trusts the certificate. The generated certificate is also unnecessarily CA-capable with broad key usages beyond its localhost HTTPS purpose. The fix writes the cache with owner-only permissions, issues a constrained non-CA server-auth leaf certificate, and bases cache expiry on content modification time.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the development server with cached TLS credentials on a system where other local users can read your files.
Background info
@quasar/app-vite is vulnerable to Incorrect Permission Assignment for Critical Resource in versions 0.0.1 - 3.2.0.
How to fix this
Upgrade the @quasar/app-vite library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant