CVE-2026-106109

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.

• CWE-22
• CWE-73

• https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1
• https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
• https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93

Published

Oct 6, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-106102Quasar Framework is a framework for building high-performanc…10
• CVE-2026-106103Quasar Framework is a framework for building high-performanc…7.1
• CVE-2026-106104Quasar Framework is a framework for building high-performanc…8.7
• CVE-2026-106105Quasar Framework is a framework for building high-performanc…8.4
• CVE-2026-106106Quasar Framework is a framework for building high-performanc…7.1
• CVE-2026-106107Quasar Framework is a framework for building high-performanc…8.3
• CVE-2026-10611An authentication bypass vulnerability exists in MISP when L…10
• CVE-2026-106110ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2,…7.5
• CVE-2026-106111ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2,…5.9
• CVE-2026-106112ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2,…7.5
• CVE-2026-106113ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2,…7.5
• CVE-2026-106114ImageSharp is a 2D graphics library. From 1.0.0-beta0001 unt…5.3