CVE-2026-106109

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-106109

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106109.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-106109

Aliases

GHSA-q9mq-245r-4g93

Published

2026-10-06T17:32:08Z

Modified

2026-10-08T02:51:17Z

Severity

4.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Details

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106109.json"
}

References

Affected packages

Git / github.com/quasarframework/quasar

Affected ranges

Type

GIT

Repo

https://github.com/quasarframework/quasar

Events

Introduced

ab00e472771b58894a2da7b04b96cc3aeef5b991

Introduced

d039d4d83b73aed61ef71fd34d4635d5a19defcd

Fixed

db082a4407936be7865c7c85dd1862bb213f0c08

Fixed

605f4da74c54bd3c3f3a22350396ca8c1ee0e084

Fixed

6c009734b406e246a0855ed060e3a822de8aecc1

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.23.3"
        },
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "3.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@quasar-extras-v1.*

@quasar-extras-v1.15.3

@quasar-extras-v1.15.4

@quasar-extras-v1.15.5

@quasar-extras-v1.15.6

@quasar-extras-v1.16.10

@quasar-extras-v1.16.16

@quasar-extras-v1.16.17

@quasar-extras-v1.17.0

@quasar-extras-v1.18.0

@quasar/app-vite-v1.*

@quasar/app-vite-v1.0.1

@quasar/app-vite-v1.0.2

@quasar/app-vite-v1.0.5

@quasar/app-vite-v1.1.0

@quasar/app-vite-v1.1.1

@quasar/app-vite-v1.1.2

@quasar/app-vite-v1.1.3

@quasar/app-vite-v1.2.0

@quasar/app-vite-v1.2.1

@quasar/app-vite-v1.2.2

@quasar/app-vite-v1.3.0

@quasar/app-vite-v1.4.0

@quasar/app-vite-v1.4.1

@quasar/app-vite-v1.4.2

@quasar/app-vite-v1.7.2

@quasar/app-vite-v1.9.5

@quasar/app-vite-v2.*

@quasar/app-vite-v2.0.0

@quasar/app-vite-v2.0.0-beta.0

@quasar/app-vite-v2.0.0-beta.1

@quasar/app-vite-v2.0.0-beta.10

@quasar/app-vite-v2.0.0-beta.11

@quasar/app-vite-v2.0.0-beta.12

@quasar/app-vite-v2.0.0-beta.13

@quasar/app-vite-v2.0.0-beta.14

@quasar/app-vite-v2.0.0-beta.15

@quasar/app-vite-v2.0.0-beta.16

@quasar/app-vite-v2.0.0-beta.17

@quasar/app-vite-v2.0.0-beta.18

@quasar/app-vite-v2.0.0-beta.19

@quasar/app-vite-v2.0.0-beta.2

@quasar/app-vite-v2.0.0-beta.20

@quasar/app-vite-v2.0.0-beta.21

@quasar/app-vite-v2.0.0-beta.22

@quasar/app-vite-v2.0.0-beta.23

@quasar/app-vite-v2.0.0-beta.24

@quasar/app-vite-v2.0.0-beta.3

@quasar/app-vite-v2.0.0-beta.4

@quasar/app-vite-v2.0.0-beta.5

@quasar/app-vite-v2.0.0-beta.6

@quasar/app-vite-v2.0.0-beta.7

@quasar/app-vite-v2.0.0-beta.8

@quasar/app-vite-v2.0.0-beta.9

@quasar/app-vite-v2.0.0-rc.1

@quasar/app-vite-v2.0.0-rc.2

@quasar/app-vite-v2.0.0-rc.3

@quasar/app-vite-v2.0.0-rc.4

@quasar/app-vite-v2.0.1

@quasar/app-vite-v2.0.2

@quasar/app-vite-v2.0.3

@quasar/app-vite-v2.0.4

@quasar/app-vite-v2.0.5

@quasar/app-vite-v2.0.6

@quasar/app-vite-v2.0.7

@quasar/app-vite-v2.0.8

@quasar/app-vite-v2.2.1

@quasar/app-vite-v2.3.0

@quasar/app-vite-v2.4.0

@quasar/app-vite-v2.4.1

@quasar/app-vite-v2.5.0

@quasar/app-vite-v2.5.1

@quasar/app-vite-v2.5.2

@quasar/app-vite-v2.5.3

@quasar/app-vite-v2.5.4

@quasar/app-vite-v3.*

@quasar/app-vite-v3.0.0

@quasar/app-vite-v3.0.0-rc.1

@quasar/app-vite-v3.0.0-rc.2

@quasar/app-vite-v3.0.0-rc.3

@quasar/app-vite-v3.0.0-rc.4

@quasar/app-vite-v3.0.0-rc.5

@quasar/app-vite-v3.0.0-rc.6

@quasar/app-vite-v3.0.1

@quasar/app-vite-v3.1.0

@quasar/app-vite-v3.2.0

@quasar/app-webpack-3.*

@quasar/app-webpack-3.5.7

@quasar/app-webpack-v3.*

@quasar/app-webpack-v3.12.2

@quasar/app-webpack-v3.13.4

@quasar/app-webpack-v3.5.3

@quasar/app-webpack-v3.5.4

@quasar/app-webpack-v3.6.0

@quasar/app-webpack-v3.6.1

@quasar/app-webpack-v3.6.2

@quasar/app-webpack-v3.7.0

@quasar/app-webpack-v3.7.1

@quasar/app-webpack-v3.7.2

@quasar/app-webpack-v3.8.0

@quasar/app-webpack-v3.9.0

@quasar/app-webpack-v3.9.1

@quasar/app-webpack-v4.*

@quasar/app-webpack-v4.0.0

@quasar/app-webpack-v4.0.0-beta.0

@quasar/app-webpack-v4.0.0-beta.1

@quasar/app-webpack-v4.0.0-beta.10

@quasar/app-webpack-v4.0.0-beta.11

@quasar/app-webpack-v4.0.0-beta.12

@quasar/app-webpack-v4.0.0-beta.13

@quasar/app-webpack-v4.0.0-beta.14

@quasar/app-webpack-v4.0.0-beta.15

@quasar/app-webpack-v4.0.0-beta.16

@quasar/app-webpack-v4.0.0-beta.17

@quasar/app-webpack-v4.0.0-beta.18

@quasar/app-webpack-v4.0.0-beta.19

@quasar/app-webpack-v4.0.0-beta.2

@quasar/app-webpack-v4.0.0-beta.20

@quasar/app-webpack-v4.0.0-beta.21

@quasar/app-webpack-v4.0.0-beta.22

@quasar/app-webpack-v4.0.0-beta.23

@quasar/app-webpack-v4.0.0-beta.24

@quasar/app-webpack-v4.0.0-beta.25

@quasar/app-webpack-v4.0.0-beta.3

@quasar/app-webpack-v4.0.0-beta.4

@quasar/app-webpack-v4.0.0-beta.5

@quasar/app-webpack-v4.0.0-beta.6

@quasar/app-webpack-v4.0.0-beta.7

@quasar/app-webpack-v4.0.0-beta.8

@quasar/app-webpack-v4.0.0-beta.9

@quasar/app-webpack-v4.0.0-rc.1

@quasar/app-webpack-v4.0.0-rc.2

@quasar/app-webpack-v4.0.0-rc.3

@quasar/app-webpack-v4.0.0-rc.4

@quasar/app-webpack-v4.0.1

@quasar/app-webpack-v4.0.2

@quasar/app-webpack-v4.0.3

@quasar/app-webpack-v4.0.4

@quasar/app-webpack-v4.0.5

@quasar/app-webpack-v4.0.6

@quasar/app-webpack-v4.0.7

@quasar/app-webpack-v4.0.8

@quasar/app-webpack-v4.2.1

@quasar/app-webpack-v4.3.0

@quasar/app-webpack-v4.3.1

@quasar/app-webpack-v4.3.2

@quasar/app-webpack-v4.4.0

@quasar/app-webpack-v4.4.1

@quasar/app-webpack-v4.4.2

@quasar/app-webpack-v4.4.3

@quasar/app-webpack-v4.4.4

@quasar/app-webpack-v4.4.5

@quasar/cli-v1.*

@quasar/cli-v1.4.0

@quasar/cli-v2.*

@quasar/cli-v2.0.0

@quasar/cli-v2.0.1

@quasar/cli-v2.1.0

@quasar/cli-v2.1.1

@quasar/cli-v2.2.0

@quasar/cli-v2.2.1

@quasar/cli-v2.2.2

@quasar/cli-v2.2.3

@quasar/cli-v2.3.0

@quasar/cli-v2.4.0

@quasar/cli-v2.4.1

@quasar/cli-v3.*

@quasar/cli-v3.0.0

@quasar/cli-v4.*

@quasar/cli-v4.0.0

@quasar/cli-v5.*

@quasar/cli-v5.0.0

@quasar/cli-v5.0.1

@quasar/cli-v5.0.2

@quasar/cli-v5.0.3

@quasar/extras-1.*

@quasar/extras-1.15.10

@quasar/extras-1.15.11

@quasar/extras-v1.*

@quasar/extras-v1.14.1

@quasar/extras-v1.14.3

@quasar/extras-v1.15.2

@quasar/extras-v1.15.7

@quasar/extras-v1.15.8

@quasar/extras-v1.15.9

@quasar/extras-v1.16.0

@quasar/extras-v1.16.1

@quasar/extras-v1.16.10

@quasar/extras-v1.16.11

@quasar/extras-v1.16.12

@quasar/extras-v1.16.14

@quasar/extras-v1.16.15

@quasar/extras-v1.16.3

@quasar/extras-v1.16.5

@quasar/extras-v1.16.6

@quasar/extras-v1.16.7

@quasar/extras-v1.16.8

@quasar/extras-v1.16.9

@quasar/extras-v1.18.0

@quasar/extras-v2.*

@quasar/extras-v2.0.0

@quasar/extras-v2.0.1

@quasar/extras-v2.0.2

@quasar/icongenie-v2.*

@quasar/icongenie-v2.5.4

@quasar/icongenie-v3.*

@quasar/icongenie-v3.0.0

@quasar/icongenie-v3.1.0

@quasar/icongenie-v3.1.1

@quasar/icongenie-v4.*

@quasar/icongenie-v4.0.0

@quasar/icongenie-v5.*

@quasar/icongenie-v5.0.0

@quasar/icongenie-v5.0.1

@quasar/icongenie-v6.*

@quasar/icongenie-v6.0.0

@quasar/icongenie-v6.1.0

@quasar/icongenie-v6.1.1

@quasar/vite-plugin-1.*

@quasar/vite-plugin-1.7.0

@quasar/vite-plugin-v1.*

@quasar/vite-plugin-v1.0.10

@quasar/vite-plugin-v1.1.0

@quasar/vite-plugin-v1.10.0

@quasar/vite-plugin-v1.10.1

@quasar/vite-plugin-v1.11.0

@quasar/vite-plugin-v1.12.0

@quasar/vite-plugin-v1.2.0

@quasar/vite-plugin-v1.2.1

@quasar/vite-plugin-v1.2.2

@quasar/vite-plugin-v1.2.3

@quasar/vite-plugin-v1.3.0

@quasar/vite-plugin-v1.3.1

@quasar/vite-plugin-v1.3.2

@quasar/vite-plugin-v1.3.3

@quasar/vite-plugin-v1.4.0

@quasar/vite-plugin-v1.4.1

@quasar/vite-plugin-v1.5.0

@quasar/vite-plugin-v1.6.0

@quasar/vite-plugin-v1.7.0

@quasar/vite-plugin-v1.8.0

@quasar/vite-plugin-v1.8.1

@quasar/vite-plugin-v1.9.0

quasar-v2.*

quasar-v2.10.0

quasar-v2.10.1

quasar-v2.10.2

quasar-v2.11.0

quasar-v2.11.1

quasar-v2.11.10

quasar-v2.11.2

quasar-v2.11.3

quasar-v2.11.4

quasar-v2.11.5

quasar-v2.11.6

quasar-v2.11.7

quasar-v2.11.8

quasar-v2.11.9

quasar-v2.12.0

quasar-v2.12.1

quasar-v2.12.2

quasar-v2.12.3

quasar-v2.12.4

quasar-v2.12.5

quasar-v2.12.6

quasar-v2.12.7

quasar-v2.13.0

quasar-v2.13.1

quasar-v2.14.0

quasar-v2.14.1

quasar-v2.14.2

quasar-v2.14.3

quasar-v2.14.4

quasar-v2.14.5

quasar-v2.14.6

quasar-v2.14.7

quasar-v2.15.0

quasar-v2.15.1

quasar-v2.15.2

quasar-v2.15.3

quasar-v2.15.4

quasar-v2.16.0

quasar-v2.16.1

quasar-v2.16.10

quasar-v2.16.11

quasar-v2.16.2

quasar-v2.16.3

quasar-v2.16.4

quasar-v2.16.5

quasar-v2.16.6

quasar-v2.16.7

quasar-v2.16.8

quasar-v2.16.9

quasar-v2.17.0

quasar-v2.17.1

quasar-v2.17.2

quasar-v2.17.3

quasar-v2.17.4

quasar-v2.17.5

quasar-v2.17.6

quasar-v2.17.7

quasar-v2.17.8

quasar-v2.18.2

quasar-v2.18.3

quasar-v2.18.4

quasar-v2.18.5

quasar-v2.18.6

quasar-v2.18.7

quasar-v2.19.0

quasar-v2.19.1

quasar-v2.19.2

quasar-v2.19.3

quasar-v2.20.0

quasar-v2.20.1

quasar-v2.20.2

quasar-v2.20.3

quasar-v2.21.0

quasar-v2.21.1

quasar-v2.21.2

quasar-v2.21.3

quasar-v2.21.4

quasar-v2.22.0

quasar-v2.23.0

quasar-v2.23.2

quasar-v2.7.0

quasar-v2.7.1

quasar-v2.7.2

quasar-v2.7.3

quasar-v2.7.5

quasar-v2.7.7

quasar-v2.8.1

quasar-v2.8.2

quasar-v2.8.3

quasar-v2.8.4

quasar-v2.9.0

quasar-v2.9.1

quasar-v2.9.2

quasar/extras-v1.*

quasar/extras-v1.15.0

quasar/extras-v1.15.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106109.json"