CVE-2026-106108

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

EUVD-2026-98736

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

CVE-2026-106108

The Quasar Framework (specifically @quasar/app-vite ) versions 3.1.0 through 3.3.0 are vulnerable to a path traversal issue during SSG builds. The getSsgPages() function fails to verify that dir and filename values remain within the build.distDir, allowing for the creation of files or directories...

CVE-2026-106108: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

Quasar Framework path traversal vulnerability

Quasar Framework versions 2.22.0 to 2.23.3 had a path traversal vulnerability. This vulnerability stemmed from the dir and filename parameters in the SSG page definitions returned by getSsgPages in @quasar/app-vite. These parameters were concatenated with build.distDir without proper validation o...

EUVD-2026-93570

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions...

EUVD-2026-93572

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained...

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

GHSA-5M6H-8G35-P3M7 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Several @quasar/app-vite SSR and SSG renderer paths interpolate ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides the nonce using untrusted data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generat...

GHSA-VHHQ-M2GM-RWC9 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

@docsector/docsector-reader (>=0.2.3, <=4.29.2), @juicyllama/frontend-core (>=0.1.9, <=0.15.6) +10 more potentially affected by CVE-2026-106109 via @quasar/app-vite (>=1.11.0, <=2.6.2)

@quasar/app-vite NPM version =1.11.0, =0.2.3, =0.1.9, =0.0.110, =0.0.50, =3.0.1, =3.0.9, =0.0.181, =0.1.0, =2.1.13, =0.2.0-alpha.3, =1.1.127, =2.0.0-beat.2, =2.0.0-beta.5 Source cves: CVE-2026-106109 Source advisory: OSV:GHSA-Q9MQ-245R-4G93...

GHSA-Q9MQ-245R-4G93 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

@docsector/docsector-reader (>=0.2.3, <=4.29.2), @juicyllama/frontend-core (>=0.1.9, <=0.15.6) +10 more potentially affected by CVE-2026-106109 via @quasar/app-vite (>=1.11.0, <=2.6.2)

@quasar/app-vite NPM version =1.11.0, =0.2.3, =0.1.9, =0.0.110, =0.0.50, =3.0.1, =3.0.9, =0.0.181, =0.1.0, =2.1.13, =0.2.0-alpha.3, =1.1.127, =2.0.0-beat.2, =2.0.0-beta.5 Source cves: CVE-2026-106109 Source advisory: GHSA-Q9MQ-245R-4G93...

EUVD-2026-93573

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories...

CVE-2026-106109

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...