https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T08:43:09.062440+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-106109 fkie_cve-2026-106109 2026-10-08T08:43:09.083235+00:00

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.

 https://vulnerability.circl.lu/vuln/ghsa-q9mq-245r-4g93 GHSA-q9mq-245r-4g93 — Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories 2026-10-08T08:43:09.083340+00:00

Affected: npm: @quasar/app-vite

## Summary

`@quasar/app-vite` recursively removes `build.distDir` before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.

## Details

The build command and mode builders passed the resolved output directory directly to `fs-extra` recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.

`quasar.config` is trusted application code, and no attacker-controlled input reaches `build.distDir` by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.

## Impact

Running a normal Quasar build with an unsafe `build.distDir` can delete data accessible to the build user before compilation begins.

## Remediation

Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit `build.allowOutsideProjectDistDir` opt-in for external output directories; and log the exact resolved target before removal.