CVE-2026-106103 in icongenie
Summary
by MITRE • 10/06/2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project directory. icongenie/lib/utils/get-assets-files.js joined those values with appDir, while icongenie/lib/utils/validate-profile-object.js required only non-empty strings, allowing parent-directory traversal. A developer who runs a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration. This issue is fixed in version 6.1.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Quasar Framework serves as a robust ecosystem for developing high-performance Vue.js applications, providing developers with various utilities to streamline the creation of user interfaces and assets. Among these tools is icongenie, a command-line utility designed to generate optimized icons from source images. The security vulnerability identified in versions prior to 6.1.1 resides within this tool, specifically affecting the profile generation workflow. This flaw represents a critical failure in input validation and path resolution logic, allowing for arbitrary file writes that can lead to severe system compromise if exploited by an attacker with access to the development environment or CI/CD pipelines where such profiles might be processed automatically.
The technical root cause of this vulnerability lies in how the icongenie tool processes user-supplied configuration data during the icon generation process. When a developer executes the generate command with a custom profile, the application accepts folder and name parameters directly from that input without sufficient sanitization or constraint checking. The internal logic utilizes appDir as a base directory for resolving output paths but fails to enforce strict boundaries around this path. Specifically, the validation module only checks if the provided strings are non-empty, neglecting to verify whether the resulting resolved path remains within the intended project scope. This oversight permits parent-directory traversal sequences, such as ../ or ..\ depending on the operating system, which allow an attacker to manipulate the file system hierarchy beyond the application's root directory.
The operational impact of this vulnerability is significant due to its potential for arbitrary code execution and persistence mechanisms. By crafting a malicious profile that specifies destination paths outside the project folder, an actor can force icongenie to write or overwrite files at any location accessible by the user executing the command. This capability extends beyond simple data corruption; it enables the modification of critical system configuration files such as shell startup scripts (.bashrc, .zshrc), build automation scripts, or other executable configurations. Consequently, an attacker could inject malicious code that executes upon subsequent logins or builds, effectively establishing persistence on the affected machine or compromising the integrity of the development environment and any downstream systems connected to it.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause files to be located outside of the intended restricted directory. Furthermore, in the context of attack tactics, this behavior is consistent with ATT&CK technique T1553: Subvert Trust Controls, as it involves bypassing security mechanisms like path restrictions to place malicious content in trusted locations. It also relates to CWE-94: Improper Control of Generation of Code (Code Injection) if the written files contain executable code that is subsequently run by the system or build tools.
To mitigate this risk and prevent similar vulnerabilities, it is imperative for developers using Quasar Framework versions prior to 6.1.1 to upgrade immediately to version 6.1.1 or later, where the path resolution logic has been hardened to strictly constrain output destinations within the project directory. For environments that cannot be updated instantly, operational mitigations include restricting file system permissions so that build tools do not have write access outside of designated directories and implementing strict input validation on any configuration files processed by icongenie. Additionally, organizations should audit their CI/CD pipelines for untrusted profile inputs to ensure that automated builds are not susceptible to this path traversal attack vector.