{"id":"EUVD-2026-93573","enisaUuid":"655a54f6-7e96-3f7e-9556-c9ebce2b4261","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","datePublished":"Oct 6, 2026, 5:32:08 PM","dateUpdated":"Oct 6, 2026, 7:43:35 PM","baseScore":4.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93\nhttps://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\n","aliases":"CVE-2026-106109\nGHSA-q9mq-245r-4g93\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"113516eb-6e7d-3355-a246-d1e24698b17b","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"2.7.0, \u003c 2.23.3"},{"id":"ebf2a350-7b9a-302e-8900-b89505ed33cf","product":{"name":"app-vite","vendor":{"name":"@quasar"}},"product_version":"1.0.0, \u003c 3.3.0"}],"enisaIdVendor":[{"id":"22cf5aa5-35ab-3116-85fa-6fcc71e03be5","vendor":{"name":"@quasar"}},{"id":"a19eb10a-49a3-3114-9735-1a90aff5bca8","vendor":{"name":"quasarframework"}}],"enisaIdVulnerability":[{"id":"23b05fab-e4fa-3501-aa0d-a9ddc825cbe7","vulnerability":{"id":"GHSA-q9mq-245r-4g93","description":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories","datePublished":"Oct 7, 2026, 4:14:35 PM","dateUpdated":"Oct 7, 2026, 4:14:35 PM","baseScore":0.0,"references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106109\nhttps://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1\nhttps://github.com/quasarframework/quasar\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\n","enisa_id":"EUVD-2026-93573\n","aliases":"GHSA-q9mq-245r-4g93\nCVE-2026-106109\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"604da235-a881-3583-8b99-4020b0db34ed","vulnerability":{"id":"CVE-2026-106109","description":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.","datePublished":"Oct 6, 2026, 5:32:08 PM","dateUpdated":"Oct 6, 2026, 7:43:35 PM","status":"PUBLISHED","baseScore":4.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93\nhttps://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1\nhttps://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0\n","enisa_id":"EUVD-2026-93573\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Nov 1, 2026, 4:04:34 AM","vulnerabilityProduct":[{"id":"316a1bb4-4990-37e6-8ab2-4f98f3d4363e","product":{"name":"quasar","vendor":{"name":"quasarframework"}},"product_version":"2.7.0, \u003c 2.23.3"},{"id":"42c7d5ed-f04d-3c20-80d7-360b706ee182","product":{"name":"app-vite","vendor":{"name":"@quasar"}},"product_version":"1.0.0, \u003c 3.3.0"}],"vulnerabilityVendor":[{"id":"8ef28373-32a9-3968-a34f-5cf7fbb7ba2d","vendor":{"name":"quasarframework"}},{"id":"90e09eee-e4d3-38ec-a424-ba24a5346a10","vendor":{"name":"@quasar"}}]}}],"enisaIdAdvisory":[]}