# CVE-2026-106109: Quasar Framework @quasar/app-vite unsafe build directory cleanup

Source: https://junglewise.ai/threats/cve-2026-106109-quasar-framework-is-a-framework-for-building-high-performance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106109 · Severity: medium · CVSS 4 · Published 2026-10-06

Quasar Framework's @quasar/app-vite is a build tool for Vue.js applications. A flaw in versions before 3.3.0 could recursively delete files outside the intended build directory if build configuration is manipulated, potentially destroying user data. Exploitation requires either compromised build automation or a developer to misconfigure the tool manually.

Technologies: [@quasar/app-vite (npm)](https://junglewise.ai/threats/technologies/npm-quasar-app-vite), [Quasar @Quasar/App-Vite](https://junglewise.ai/threats/technologies/quasar-app-vite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Quasar](https://junglewise.ai/threats/vendors/quasar).

## Quick answers

**Is CVE-2026-106109 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106109 being exploited in the wild.

**How severe is CVE-2026-106109?** Medium severity, with a CVSS score of 4, published 6 October 2026.

**Which products and versions are affected?** @quasar/app-vite (npm) >= 1.0.0, <= 3.2.0, SEMVER:introduced=1.0.0,fixed=3.3.0; Quasar @Quasar/App-Vite 1.0.0 to 3.2.x.

**Is there a fix for CVE-2026-106109?** Yes. @quasar/app-vite (npm): upgrade to 3.3.0 or later. Until then: Restrict write access to build configuration files and use trusted build automation. Avoid running builds with build.distDir pointing outside the project directory unless necessary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106109 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-106109?** Check whether you run @quasar/app-vite (npm) or Quasar @Quasar/App-Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @quasar/app-vite (npm): upgrade to 3.3.0 or later

  ```sh
  npm install @quasar/app-vite@3.3.0
  ```


Restrict write access to build configuration files and use trusted build automation. Avoid running builds with build.distDir pointing outside the project directory unless necessary.

## Technical details

The @quasar/app-vite build tool recursively removed the build.distDir without safeguards against project root, home directory, filesystem roots, or symlink-resolved external directories. An attacker with write access to build configuration (or a developer with misconfigured settings) could specify a dangerous path as distDir, causing data deletion before compilation begins. The fix adds validation to reject unsafe paths and introduces an allowOutsideProjectDistDir configuration option.

## Affected products

- Quasar @quasar/app-vite 1.0.0 to 3.2.x

## Identifiers

- CVE-2026-106109
- GHSA-q9mq-245r-4g93

## Timeline

- 2026-10-06: disclosed
- 2026-07-28: patched

## References

- [https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1](https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1)
- [https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0](https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0)

## Related threats

- [Quasar Framework App Vite SSG path traversal in output directory](https://junglewise.ai/threats/cve-2026-106108-quasar-framework-app-vite-ssg-page-output-paths-can-escape-the)
- [Quasar Framework SSR/SSG nonce injection in HTML attributes](https://junglewise.ai/threats/cve-2026-106107-quasar-framework-is-a-framework-for-building-high-performance)
- [Quasar Framework SSR/SSG information disclosure in development server](https://junglewise.ai/threats/cve-2026-106106-quasar-framework-is-a-framework-for-building-high-performance)
- [Quasar Framework SSL certificate cache permissions vulnerability](https://junglewise.ai/threats/cve-2026-106105-quasar-framework-is-a-framework-for-building-high-performance)