Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@quasar/icongenie

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1npmAmendedPublished

    Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

    CVE-2026-106103 · GHSA-wmpw-j6qv-mw88

    Affected
    • npm @quasar/icongenie < 6.1.1
    Fixed in
    6.1.1· Vendor fix available
    Issue
    Vulnerability Details File: icongenie/lib/utils/get-assets-files.js (line 35, absoluteName: join(appDir, asset.folder, asset.name)) Validation gap: icongenie/lib/utils/validate-profile-object.js (assetsSchema) — folder/name only checked with Joi.string().required().min(1), no restriction on .. sequences or absolute paths Entry point: icongenie/lib/runner/generate.js (generate(argv)) — profile.assets = userProfile.assets, loaded verbatim from a user-supplied JSON file via --profile <file Root Cause icongenie generate --profile <file loads a JSON "profile" describing icon/splashscreen assets to generate, where each asset entry has a folder/name describing where the generated file should be written relative to the Quasar project directory (appDir). getAssetsFiles() builds the write target with join(appDir, asset.folder, asset.name). Node's path.join normalizes .. segments arithmetically and does not clamp the result to stay inside appDir. The only validation before this…

    Recommended action: Upgrade to 6.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →