CVE-2026-106109 Quasar Framework CVE debrief

Who should care

Defenders responsible for Quasar Framework applications using @quasar/app-vite should assess exposure and verify build configurations to prevent data loss. This includes operators, platform administrators, vulnerability management teams, and security teams who need to validate effective deletion targets before artifact cleanup to prevent data loss.

Why it matters

Defenders should prioritize validating deletion targets to prevent data loss due to a vulnerability in @quasar/app-vite.

• Potential data loss due to unsafe deletion targets
• Need to validate effective deletion targets before artifact cleanup
• Verify build configuration to prevent data loss
• Update to fixed version to prevent vulnerability

Technical summary

The @quasar/app-vite package recursively removes the build.distDir before producing build artifacts without checking if the path is safe, potentially leading to data loss if the configured path targets sensitive directories. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation. Defenders should prioritize validating deletion targets to prevent data loss due to this vulnerability in @quasar/app-vite.

Defensive priority

Defenders should prioritize validating the effective deletion target before every artifact cleanup to prevent data loss.

Recommended defensive actions

• Validate the effective deletion target before every artifact cleanup
• Always reject filesystem roots, the user home directory, and other sensitive directories
• Verify build configuration to prevent unsafe deletion targets
• Update to version 3.3.0 or later of @quasar/app-vite
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the source corpus indicates that @quasar/app-vite recursively removes build.distDir before producing build artifacts without checking the path, potentially targeting project roots, user home directories, or filesystem roots. The source item detailing the vulnerability provides further context on the issue. Official CVE Program record and NIST NVD detail page offer additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.