8 matches found
CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...
CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...
GHSA-Q9MQ-245R-4G93 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...
CVE-2026-106109
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...
CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...
CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...
CVE-2026-106109
The Quasar Framework 's @quasar/app-vite component (versions 1.0.0 through 3.3.0) contains a vulnerability where it recursively removes the build.distDir before building. The root cause is a lack of validation to reject sensitive paths such as the project root, user home directory, filesystem roo...