{"id":"CVE-2026-106109","summary":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","details":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","aliases":["GHSA-q9mq-245r-4g93"],"modified":"2026-10-08T02:51:17.641795413Z","published":"2026-10-06T17:32:08.136Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106109.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-73"]},"references":[{"type":"WEB","url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106109.json"},{"type":"ADVISORY","url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106109"},{"type":"FIX","url":"https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/quasarframework/quasar","events":[{"introduced":"ab00e472771b58894a2da7b04b96cc3aeef5b991"},{"introduced":"d039d4d83b73aed61ef71fd34d4635d5a19defcd"},{"fixed":"db082a4407936be7865c7c85dd1862bb213f0c08"},{"fixed":"605f4da74c54bd3c3f3a22350396ca8c1ee0e084"},{"fixed":"6c009734b406e246a0855ed060e3a822de8aecc1"}],"database_specific":{"extracted_events":[{"introduced":"2.7.0"},{"fixed":"2.23.3"},{"introduced":"1.0.0"},{"fixed":"3.3.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["quasar-v2.23.2","quasar-v2.23.0","@quasar/app-vite-v3.2.0","quasar-v2.22.0","@quasar/app-vite-v3.1.0","@quasar/icongenie-v6.1.1","@quasar/cli-v5.0.3","quasar-v2.21.4","@quasar/icongenie-v6.1.0","quasar-v2.21.3","quasar-v2.21.2","@quasar/app-vite-v3.0.1","@quasar/app-vite-v3.0.0","quasar-v2.21.1","@quasar/app-vite-v3.0.0-rc.6","quasar-v2.21.0","@quasar/extras-v2.0.2","quasar-v2.20.3","@quasar/app-vite-v3.0.0-rc.5","@quasar/app-vite-v3.0.0-rc.4","@quasar/cli-v5.0.2","quasar-v2.20.2","quasar-v2.20.1","@quasar/app-vite-v3.0.0-rc.3","@quasar/icongenie-v6.0.0","@quasar/extras-v2.0.1","@quasar/app-vite-v3.0.0-rc.2","@quasar/app-vite-v3.0.0-rc.1","quasar-v2.20.0","@quasar/icongenie-v5.0.1","@quasar/cli-v5.0.1","@quasar/extras-v2.0.0","@quasar/icongenie-v5.0.0","@quasar/cli-v5.0.0","@quasar/vite-plugin-v1.12.0","@quasar/extras-v1.18.0","@quasar/cli-v4.0.0","quasar-v2.19.3","@quasar/app-webpack-v4.4.5","@quasar-extras-v1.18.0","quasar-v2.19.2","quasar-v2.19.1","quasar-v2.19.0","@quasar/app-webpack-v4.4.4","@quasar/app-vite-v2.5.4","@quasar/cli-v3.0.0","@quasar/app-vite-v2.5.3","@quasar/app-webpack-v4.4.3","@quasar/app-webpack-v4.4.2","@quasar/app-vite-v2.5.2","quasar-v2.18.7","@quasar/app-webpack-v4.4.1","@quasar/app-vite-v2.5.1","@quasar/app-vite-v2.5.0","@quasar/app-webpack-v4.4.0","@quasar/vite-plugin-v1.11.0","@quasar/vite-plugin-v1.10.1","@quasar/app-webpack-v4.3.2","@quasar/app-vite-v2.4.1","quasar-v2.18.6","quasar-v2.18.5","quasar-v2.18.4","quasar-v2.18.3","@quasar/app-vite-v2.4.0","@quasar/app-webpack-v4.3.1","quasar-v2.18.2","@quasar/app-vite-v2.3.0","@quasar/app-webpack-v4.3.0","@quasar/vite-plugin-v1.10.0","@quasar/app-webpack-v4.2.1","@quasar/app-vite-v2.2.1","@quasar-extras-v1.17.0","@quasar-extras-v1.16.17","@quasar-extras-v1.16.16","quasar-v2.17.8","quasar-v2.17.7","@quasar/app-vite-v2.0.8","@quasar/app-webpack-v4.0.8","@quasar/vite-plugin-v1.9.0","@quasar/app-webpack-v4.0.7","@quasar/app-vite-v2.0.7","@quasar/app-vite-v2.0.6","@quasar/app-webpack-v4.0.6","quasar-v2.17.6","@quasar/app-webpack-v4.0.5","@quasar/app-vite-v2.0.5","@quasar/app-webpack-v4.0.4","@quasar/app-vite-v2.0.4","@quasar/app-webpack-v4.0.3","@quasar/app-vite-v2.0.3","quasar-v2.17.5","@quasar/app-vite-v2.0.2","@quasar/app-webpack-v4.0.2","@quasar/app-webpack-v4.0.1","@quasar/app-vite-v2.0.1","@quasar/extras-v1.16.15","@quasar/app-webpack-v4.0.0","@quasar/app-vite-v2.0.0","@quasar/extras-v1.16.14","@quasar/app-webpack-v4.0.0-rc.4","@quasar/app-vite-v2.0.0-rc.4","@quasar/app-webpack-v4.0.0-rc.3","@quasar/app-vite-v2.0.0-rc.3","quasar-v2.17.4","@quasar/app-webpack-v4.0.0-rc.2","@quasar/app-vite-v2.0.0-rc.2","@quasar/app-webpack-v4.0.0-rc.1","@quasar/app-vite-v2.0.0-rc.1","quasar-v2.17.3","@quasar/vite-plugin-v1.8.1","quasar-v2.17.2","quasar-v2.17.1","@quasar/vite-plugin-v1.8.0","@quasar/app-webpack-v4.0.0-beta.25","@quasar/app-vite-v2.0.0-beta.24","@quasar/app-webpack-v4.0.0-beta.24","@quasar/app-vite-v2.0.0-beta.23","@quasar/app-webpack-v4.0.0-beta.23","@quasar/app-vite-v2.0.0-beta.22","quasar-v2.17.0","quasar-v2.16.11","quasar-v2.16.10","@quasar/app-webpack-v4.0.0-beta.22","@quasar/app-vite-v2.0.0-beta.21","@quasar/app-webpack-v4.0.0-beta.21","@quasar/app-vite-v2.0.0-beta.20","quasar-v2.16.9","@quasar/app-webpack-v4.0.0-beta.20","@quasar/app-webpack-v3.13.4","@quasar/app-vite-v1.9.5","@quasar/app-vite-v2.0.0-beta.19","@quasar/app-vite-v2.0.0-beta.18","@quasar/app-webpack-v4.0.0-beta.19","quasar-v2.16.8","@quasar/app-vite-v2.0.0-beta.17","@quasar/app-webpack-v4.0.0-beta.18","@quasar/app-vite-v2.0.0-beta.16","@quasar/app-webpack-v4.0.0-beta.17","quasar-v2.16.7","@quasar/app-vite-v2.0.0-beta.15","@quasar/app-webpack-v4.0.0-beta.16","quasar-v2.16.6","@quasar/extras-v1.16.12","quasar-v2.16.5","quasar-v2.16.4","quasar-v2.16.3","quasar-v2.16.2","@quasar/app-webpack-v4.0.0-beta.15","@quasar/app-vite-v2.0.0-beta.14","@quasar/app-webpack-v4.0.0-beta.14","@quasar/app-vite-v2.0.0-beta.13","quasar-v2.16.1","quasar-v2.16.0","@quasar/vite-plugin-v1.7.0","@quasar/vite-plugin-1.7.0","@quasar/app-webpack-v4.0.0-beta.13","@quasar/app-vite-v2.0.0-beta.12","@quasar/cli-v2.4.1","@quasar/app-webpack-v4.0.0-beta.12","@quasar/app-vite-v2.0.0-beta.11","@quasar/app-webpack-v4.0.0-beta.11","@quasar/app-vite-v2.0.0-beta.10","@quasar/app-vite-v2.0.0-beta.9","quasar-v2.15.4","@quasar/app-webpack-v4.0.0-beta.10","@quasar/app-vite-v2.0.0-beta.8","@quasar/app-webpack-v4.0.0-beta.9","@quasar/app-vite-v2.0.0-beta.7","quasar-v2.15.3","@quasar/app-vite-v2.0.0-beta.6","@quasar/app-webpack-v4.0.0-beta.8","quasar-v2.15.2","@quasar/extras-v1.16.11","@quasar/extras-v1.16.10","@quasar-extras-v1.16.10","quasar-v2.15.1","quasar-v2.15.0","@quasar/app-vite-v2.0.0-beta.5","@quasar/app-webpack-v4.0.0-beta.7","quasar-v2.14.7","@quasar/cli-v2.4.0","@quasar/app-webpack-v4.0.0-beta.6","@quasar/app-vite-v2.0.0-beta.4","@quasar/app-webpack-v4.0.0-beta.5","@quasar/app-webpack-v4.0.0-beta.4","@quasar/app-vite-v2.0.0-beta.3","quasar-v2.14.6","@quasar/icongenie-v4.0.0","@quasar/app-webpack-v4.0.0-beta.3","quasar-v2.14.5","@quasar/app-vite-v2.0.0-beta.2","@quasar/app-webpack-v4.0.0-beta.2","quasar-v2.14.4","@quasar/app-webpack-v4.0.0-beta.1","@quasar/app-webpack-v4.0.0-beta.0","@quasar/app-vite-v2.0.0-beta.1","@quasar/app-vite-v2.0.0-beta.0","quasar-v2.14.3","@quasar/app-webpack-v3.12.2","@quasar/app-vite-v1.7.2","quasar-v2.14.2","@quasar/extras-v1.16.9","quasar-v2.14.1","quasar-v2.14.0","quasar-v2.13.1","@quasar/extras-v1.16.8","@quasar/vite-plugin-v1.6.0","quasar-v2.13.0","@quasar/extras-v1.16.7","quasar-v2.12.7","@quasar/cli-v2.3.0","@quasar/vite-plugin-v1.5.0","quasar-v2.12.6","@quasar/extras-v1.16.6","quasar-v2.12.5","@quasar/cli-v2.2.3","quasar-v2.12.4","@quasar/cli-v2.2.2","@quasar/icongenie-v3.1.1","quasar-v2.12.3","@quasar/extras-v1.16.5","quasar-v2.12.2","@quasar/vite-plugin-v1.4.1","quasar-v2.12.1","@quasar/vite-plugin-v1.4.0","@quasar/icongenie-v3.1.0","@quasar/cli-v2.2.1","@quasar/cli-v2.2.0","@quasar/app-webpack-v3.9.1","@quasar/app-vite-v1.4.2","@quasar/vite-plugin-v1.3.3","@quasar/cli-v2.1.1","@quasar/app-vite-v1.4.1","@quasar/vite-plugin-v1.3.2","@quasar/app-webpack-v3.9.0","@quasar/app-vite-v1.4.0","@quasar/app-webpack-v3.8.0","@quasar/app-vite-v1.3.0","@quasar/cli-v2.1.0","quasar-v2.12.0","@quasar/cli-v2.0.1","@quasar/icongenie-v3.0.0","@quasar/extras-v1.16.3","@quasar/app-vite-v1.2.2","@quasar/vite-plugin-v1.3.1","quasar-v2.11.10","@quasar/extras-v1.16.1","@quasar/extras-v1.16.0","quasar-v2.11.9","quasar-v2.11.8","quasar-v2.11.7","@quasar/app-webpack-v3.7.2","@quasar/app-vite-v1.2.1","quasar-v2.11.6","@quasar/extras-1.15.11","@quasar/extras-1.15.10","@quasar/app-webpack-v3.7.1","@quasar/app-webpack-v3.7.0","@quasar/app-vite-v1.2.0","@quasar/cli-v2.0.0","quasar-v2.11.5","quasar-v2.11.4","@quasar/cli-v1.4.0","quasar-v2.11.3","@quasar/extras-v1.15.9","quasar-v2.11.2","quasar-v2.11.1","quasar-v2.11.0","quasar-v2.10.2","@quasar/vite-plugin-v1.3.0","@quasar/extras-v1.15.8","@quasar/extras-v1.15.7","@quasar-extras-v1.15.6","@quasar/icongenie-v2.5.4","quasar-v2.10.1","@quasar-extras-v1.15.5","quasar-v2.10.0","@quasar/app-vite-v1.1.3","@quasar/app-webpack-v3.6.2","quasar-v2.9.2","quasar-v2.9.1","quasar-v2.9.0","@quasar-extras-v1.15.4","@quasar/vite-plugin-v1.2.3","quasar-v2.8.4","@quasar/app-vite-v1.1.2","@quasar/app-webpack-v3.6.1","@quasar/vite-plugin-v1.2.2","@quasar/app-vite-v1.1.1","@quasar/vite-plugin-v1.2.1","quasar-v2.8.3","quasar-v2.8.2","quasar-v2.8.1","@quasar/app-vite-v1.1.0","@quasar/app-webpack-v3.6.0","@quasar/vite-plugin-v1.2.0","@quasar-extras-v1.15.3","@quasar/extras-v1.15.2","quasar-v2.7.7","quasar/extras-v1.15.1","@quasar/vite-plugin-v1.1.0","quasar/extras-v1.15.0","@quasar/extras-v1.14.3","quasar-v2.7.5","@quasar/app-vite-v1.0.5","@quasar/app-webpack-3.5.7","@quasar/extras-v1.14.1","quasar-v2.7.3","quasar-v2.7.2","@quasar/app-vite-v1.0.2","@quasar/app-webpack-v3.5.4","quasar-v2.7.1","@quasar/app-vite-v1.0.1","@quasar/app-webpack-v3.5.3","@quasar/vite-plugin-v1.0.10","quasar-v2.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106109.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}