CVE-2026-106109: Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
@quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.
References
- github.com/advisories/GHSA-q9mq-245r-4g93
- github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1
- github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
- github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93
- nvd.nist.gov/vuln/detail/CVE-2026-106109
Code Behaviors & Features
Detect and mitigate CVE-2026-106109 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →