CVE-2026-106109: @quasar App-Vite

Medium severity, CVSS 4.1. EPSS: 0.1% chance of exploitation in the next 30 days.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.

Affected products

• @quasar App-Vite: from 1.0.0, before 3.3.0 (fixed in 3.3.0)
• Quasarframework Quasar: from 2.7.0, before 2.23.3 (fixed in 2.23.3)

Published 2026-10-06. Last modified 2026-10-06.