Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Type: CWE-22 Path Traversal / Arbitrary File Write Auth required: No network auth — local CLI trust; requires the developer to run icongenie against a profile they didn't fully author/audit themselves Consequence: Arbitrary file write/overwrite at any path the running user can write to, scoped by the number of .. segments — can lead to persistence (cron/shell rc file) or supply-chain-style code execution if the written file is later executed/sourced.