{"id":"CVE-2026-106109","aliases":["GHSA-q9mq-245r-4g93"],"url":"https://o3.security/vulnerability/CVE-2026-106109","summary":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","details":"## Summary\n\n`@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.\n\n## Details\n\nThe build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.\n\n`quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.\n\n## Impact\n\nRunning a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins.\n\n## Remediation\n\nValidate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.","published":"2026-10-06T17:32:08.136Z","modified":"2026-10-21T02:54:35.054628991Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@quasar/app-vite","fixedVersion":"3.3.0"}],"fix":{"url":"https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1","label":"quasarframework/quasar@6c00973"},"references":[{"type":"WEB","url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106109.json"},{"type":"ADVISORY","url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106109"},{"type":"FIX","url":"https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1"},{"type":"PACKAGE","url":"https://github.com/quasarframework/quasar"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:35.054628991Z"}}