CVE-2026-106108: Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
During an SSG build, page definitions returned by getSsgPages() can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory.
References
- github.com/advisories/GHSA-vhhq-m2gm-rwc9
- github.com/quasarframework/quasar/commit/cdd4daeec839215540221122763c7a17cd478abc
- github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.1.0
- github.com/quasarframework/quasar/security/advisories/GHSA-vhhq-m2gm-rwc9
- nvd.nist.gov/vuln/detail/CVE-2026-106108
Code Behaviors & Features
Detect and mitigate CVE-2026-106108 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →