CVE-2026-106109 in app-vite
Summary
by MITRE • 10/06/2026
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Quasar Framework serves as a robust toolset for developing high-performance user interfaces using Vue.js, yet versions ranging from 1.0.0 through 3.3.0 contained a critical directory traversal vulnerability within the build process of @quasar/app-vite. This flaw stems from an unsafe implementation in how the framework handles the resolution and cleanup of the output directory prior to compilation. Specifically, when initiating a build, the tool recursively deletes the contents of the resolved distDir without performing adequate validation against path traversal attacks or boundary checks for sensitive system locations. The logic fails to reject attempts to target the project root, the user home directory, absolute filesystem roots such as C: on Windows or / on Unix-like systems, and directories that have been symlink-resolved from external sources. This lack of sanitization allows a maliciously crafted configuration file to direct the deletion routine toward arbitrary paths accessible by the build process user account.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes scenarios where software does not properly neutralize special elements within a pathname that can cause the path to resolve to unintended locations. The operational impact is severe because it enables arbitrary file deletion with the privileges of the user executing the build command. Since modern development environments often run builds under accounts with write permissions to their home directories and project folders, an attacker who gains control over the build configuration or automation pipeline could delete critical files outside the intended application directory structure. This includes personal documents in the home folder, system configurations at root levels if privileges are escalated, or other projects stored on the same filesystem partition. The destruction of these files can lead to significant data loss and operational disruption for development teams relying on automated build pipelines.
Exploitation of this vulnerability does not occur through standard user input within the application itself but rather requires influence over the build configuration process. This typically involves scenarios where a developer inadvertently includes a malicious or incorrectly configured file in their project, or more critically, when an attacker compromises a continuous integration and deployment pipeline to inject a poisoned configuration artifact. Because no direct attacker-controlled input reaches the distDir during normal operation of the built application itself, this is not a remote code execution vulnerability but rather a supply chain attack vector targeting the development workflow. The threat actor must have some level of access or trust within the build environment to manipulate the quasar.config.js or similar configuration files that define the output directory path.
The issue was addressed in version 3.3.0 by implementing strict validation checks before any recursive deletion occurs. These mitigations ensure that the resolved distDir is strictly confined within the expected project boundaries and explicitly reject paths pointing to system roots, home directories, or external symlinks. To mitigate this risk in environments still running older versions, organizations should immediately upgrade @quasar/app-vite to version 3.3.0 or later. For those unable to update instantly, it is crucial to audit build configuration files for any dynamic path resolution that might be influenced by environment variables or external inputs. Additionally, restricting the permissions of the user account running the build process can limit the blast radius of such a deletion event, ensuring that even if an attacker manipulates the config, they cannot access sensitive areas outside their designated project workspace. This incident highlights the importance of validating file system operations in development tools to prevent supply chain attacks from escalating into destructive data loss events.