Is CVE-2026-106109 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106109 being exploited in the wild.

How severe is CVE-2026-106109?

Medium severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

@quasar/app-vite (npm) >= 1.0.0, <= 3.2.0, SEMVER:introduced=1.0.0,fixed=3.3.0; Quasar @Quasar/App-Vite 1.0.0 to 3.2.x.

How is CVE-2026-106109 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-106109?

Check whether you run @quasar/app-vite (npm) or Quasar @Quasar/App-Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106109: Quasar Framework @quasar/app-vite unsafe build directory cleanup

Q: Is there a fix for CVE-2026-106109?

Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later. Until then: Restrict write access to build configuration files and use trusted build automation. Avoid running builds with build.distDir pointing outside the project directory unless necessary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-106109 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-106109?

Check whether you run @quasar/app-vite (npm) or Quasar @Quasar/App-Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106109 · Severity: medium · CVSS 4 · Published 2026-10-06

Quasar Framework's @quasar/app-vite is a build tool for Vue.js applications. A flaw in versions before 3.3.0 could recursively delete files outside the intended build directory if build configuration is manipulated, potentially destroying user data. Exploitation requires either compromised build automation or a developer to misconfigure the tool manually.

Technologies: @quasar/app-vite (npm), Quasar @Quasar/App-Vite. Vendors: npm, Quasar.

Quick answers

Is CVE-2026-106109 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106109 being exploited in the wild.
How severe is CVE-2026-106109?: Medium severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: @quasar/app-vite (npm) >= 1.0.0, <= 3.2.0, SEMVER:introduced=1.0.0,fixed=3.3.0; Quasar @Quasar/App-Vite 1.0.0 to 3.2.x.
Is there a fix for CVE-2026-106109?: Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later. Until then: Restrict write access to build configuration files and use trusted build automation. Avoid running builds with build.distDir pointing outside the project directory unless necessary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106109 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-106109?: Check whether you run @quasar/app-vite (npm) or Quasar @Quasar/App-Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@quasar/app-vite (npm): upgrade to 3.3.0 or later
```
npm install @quasar/app-vite@3.3.0
```

Restrict write access to build configuration files and use trusted build automation. Avoid running builds with build.distDir pointing outside the project directory unless necessary.

Technical details

The @quasar/app-vite build tool recursively removed the build.distDir without safeguards against project root, home directory, filesystem roots, or symlink-resolved external directories. An attacker with write access to build configuration (or a developer with misconfigured settings) could specify a dangerous path as distDir, causing data deletion before compilation begins. The fix adds validation to reject unsafe paths and introduces an allowOutsideProjectDistDir configuration option.

Affected products

Quasar @quasar/app-vite 1.0.0 to 3.2.x

Identifiers

CVE-2026-106109
GHSA-q9mq-245r-4g93

Timeline

2026-10-06: disclosed
2026-07-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.