CVE-2026-106109: Quasar Framework App Vite Build Cleanup Can Vulnerability
MODERATECVE-2026-106109 is a MODERATE app vite build cleanup can vulnerability (CWE-73: External Control of File Name or Path) affecting Quasar Framework libraries in the npm ecosystem. The issue involves app vite build cleanup can recursively remove unsafe configured output directories. Remediation is available by upgrading affected packages to version 3.3.0.
CVE-2026-106109 at a Glance
How to Fix CVE-2026-106109
To remediate this vulnerability, upgrade all affected Quasar Framework dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @quasar/app-vite@3.3.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @quasar/app-viteHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-106109, inspect your project dependencies using npm:
npm ls @quasar/app-viteAnalyze the terminal output to locate any version of Quasar Framework in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.3.0), your application is affected.
Note: The npm ls @quasar/app-vite command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-73: External Control of File Name or Path, where the product allows user input to control or influence paths or file names that are used in filesystem operations. In Quasar Framework, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-106109 Affected Quasar Framework Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@quasar/app-vite
|
npm |
≥ 1.0.0
< 3.3.0
|
3.3.0
|
References
Frequently Asked Questions
What is CVE-2026-106109?
Which Quasar Framework versions are affected?
What version fixes CVE-2026-106109?
Is @quasar/app-vite affected?
What CWE is associated with CVE-2026-106109?
How can I check npm dependencies for CVE-2026-106109?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-q9mq-245r-4g93",
"modified" : "2026-10-07T16:14:35Z",
"published" : "2026-10-07T16:14:35Z",
"aliases" : [ "CVE-2026-106109" ],
"summary" : "Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories",
"details" : "## Summary\n\n`@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.\n\n## Details\n\nThe build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.\n\n`quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.\n\n## Impact\n\nRunning a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins.\n\n## Remediation\n\nValidate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@quasar/app-vite"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.0.0"
}, {
"fixed" : "3.3.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 3.2.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-106109"
}, {
"type" : "WEB",
"url" : "https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/quasarframework/quasar"
}, {
"type" : "WEB",
"url" : "https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-73" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-10-07T16:14:35Z",
"nvd_published_at" : "2026-10-06T18:16:52Z"
}
}