Quasar App Vite SSG output paths can escape the distribution directory
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
@quasar/app-vite from 3.1.0 before 3.3.0 joins the dir and filename values returned by getSsgPages() to build.distDir without checking the final destination. Parent directory traversal or an existing symlink below the distribution directory can create HTML files or directories outside the output tree, with the build user's permissions (CWE-22). Exploitation requires a build that derives SSG page definitions from external or less-trusted content, since application configuration and these definitions are trusted by default; existing files remain protected by the renderer's no-overwrite behavior. CVSS 4.0 scores it 5.7 (MEDIUM).
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions. Application configuration and SSG page definitions are trusted by default, so exploitation requires a build process that derives them from external or otherwise less-trusted content; existing files remain protected by the renderer's no-overwrite behavior. This issue is fixed in version 3.3.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| quasarframework | quasar | 2.22.0 to before 2.23.3 | 2.23.3 | Patch available | CNA |
| @quasar | app-vite | 3.1.0 to before 3.3.0 | 3.3.0 | Patch available | CNA |
| — | @quasar/app-vite (npm) | 3.1.0 to before 3.3.0 | 3.3.0 | Patch available | GHSA-vhhq-m2gm-rwc9 |
- quasar Vendorquasarframework Affected 2.22.0 to before 2.23.3 Fixed in 2.23.3 Patch available CNA
- app-vite Vendor@quasar Affected 3.1.0 to before 3.3.0 Fixed in 3.3.0 Patch available CNA
- @quasar/app-vite (npm) Vendor— Affected 3.1.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-vhhq-m2gm-rwc9
Remediation
Upgrade @quasar/app-vite to version 3.3.0. For the quasar package, upgrade to 2.23.3.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA quasar (quasarframework) Fixed in 2.23.3
- Fix · CNA app-vite (@quasar) Fixed in 3.3.0
- Fix · GHSA-vhhq-m2gm-rwc9 @quasar/app-vite (npm) Fixed in 3.3.0 Advisory →
Vendor assessments
Timeline
- 2026-10-13 Threatist record created from CVE-2026-106108
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/quasarframework/quasar/security/advisories/GHSA-vhhq-m2gm-rwc9
- https://github.com/quasarframework/quasar/commit/cdd4daeec839215540221122763c7a17cd478abc
- https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
- https://github.com/quasarframework/quasar
- https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.1.0
More quasarframework vulnerabilities
- TI-2026-68624 Regex backtracking on User-Agent header stalls Quasar SSR servers CVSS 4.0HIGH 8.7
- TI-2026-68626 Quasar SSR dev error page leaks environment secrets and enables XSS CVSS 4.0HIGH 7.1
- TI-2026-51731 Quasar Framework: Prototype pollution in Quasar extend() utility CVSS 3.1MEDIUM 5.6
- TI-2026-68622 Cross-site scripting in Quasar Framework SSR meta tags CVSS 3.1CRITICAL 10.0
- TI-2026-68621 Type confusion in quasarframework quasar CVSS 3.1LOW 3.1
- TI-2026-68625 Quasar caches development TLS keys with lax file permissions CVSS 4.0HIGH 8.4
Sources
- CVE-2026-106108 · CVE Program
- CVE-2026-106108 · NVD
- FIRST EPSS
- CVE-2026-106108 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences