CVE-2026-106103

Name of the Vulnerable Software and Affected Versions @quasar/icongenie versions prior to 6.1.1

Description The icongenie generate --profile command fails to constrain the resolved destination to the Quasar project directory when processing folder and name values from a user-supplied profile. The icongenie/lib/utils/get-assets-files.js file joins these values with appDir, while icongenie/lib/utils/validate-profile-object.js only verifies that the strings are not empty. This allows parent-directory traversal, enabling a developer to run a crafted profile that writes or overwrites image content at any path writable by the user, which could lead to the modification of shell startup files, build scripts, or other executable configurations.

Recommendations Update to version 6.1.1.