AIKIDO-2026-625157
@quasar/app-vite is vulnerable to Incorrect Permission Assignment for Critical Resource
55
CVE Score
Medium
Incorrect Permission Assignment for Critical Resource
TL;DR
The development TLS helper used by @quasar/app-vite caches a combined PEM containing a generated private key and certificate without restricting its filesystem permissions. Under a typical process umask the file can be readable by other local users, allowing a co-located user to copy the private key and impersonate a development TLS endpoint that trusts the certificate. The generated certificate is also unnecessarily CA-capable with broad key usages beyond its localhost HTTPS purpose. The fix writes the cache with owner-only permissions, issues a constrained non-CA server-auth leaf certificate, and bases cache expiry on content modification time.
How do I fix this?
Upgrade the @quasar/app-vite library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the development server with cached TLS credentials on a system where other local users can read your files.
Package
Versions
0.0.1 - 3.2.0
Fixed in 3.3.0Background info
@quasar/app-vite is vulnerable to Incorrect Permission Assignment for Critical Resource in versions 0.0.1 - 3.2.0.
Links
GitHub Releases
github.com/quasarframework/quasar/releases/tag/%40quasar%2Fapp-vite-v3.3.0github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0github.com/quasarframework/quasar/releases/tag/@quasar/cli-v5.0.4
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.