{"schema":"threatline.record/2","record":{"id":"CVE-2026-106109","aliases":["GHSA-q9mq-245r-4g93"],"summary":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","details":"## Summary\n\n`@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.\n\n## Details\n\nThe build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.\n\n`quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.\n\n## Impact\n\nRunning a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins.\n\n## Remediation\n\nValidate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.","categories":["Libraries & packages"],"product":"@quasar/app-vite","vendor":"quasarframework","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-q9mq-245r-4g93","source_modified_at":"2026-10-07T16:14:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@quasar/app-vite"},"range":">= 1.0.0, <= 3.2.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106109","source_modified_at":"2026-10-06T19:43:35.076Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"quasar","vendor":"quasarframework","versions":[{"version":">= 2.7.0, < 2.23.3","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106109","source_modified_at":"2026-10-06T19:43:35.076Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"app-vite","vendor":"@quasar","versions":[{"version":">= 1.0.0, < 3.3.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-q9mq-245r-4g93","source_modified_at":"2026-10-07T16:30:06.349887482Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@quasar/app-vite","purl":"pkg:npm/%40quasar/app-vite"},"ranges":[{"events":[{"introduced":"1.0.0"},{"fixed":"3.3.0"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-q9mq-245r-4g93","source_modified_at":"2026-10-07T16:14:36Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@quasar/app-vite"},"version":"3.3.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-q9mq-245r-4g93","source_modified_at":"2026-10-07T16:30:06.349887482Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@quasar/app-vite","purl":"pkg:npm/%40quasar/app-vite"},"version":"3.3.0"}],"cvss":4.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00125,"percentile":0.02017,"score_date":"2026-10-23"},"published_at":"2026-10-06T17:32:08.136Z","modified_at":"2026-10-07T16:30:06.349887482Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-q9mq-245r-4g93","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T16:14:36Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106109","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T19:43:35.076Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-q9mq-245r-4g93","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T16:30:06.349887482Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106109","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106109","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-q9mq-245r-4g93","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T19:43:25.036654Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T16:30:06.349887482Z","content_hash":"57c812a51babd398237df11d21b5376d850739b8af8e93644f14e83e9324dbc0"}}