{"action":"Upgrade @quasar/app-vite to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"1.0.0"}],"component":"@quasar/app-vite","cve_ids":["CVE-2026-106109"],"ecosystem":"npm","epss":0.00126,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-q9mq-245r-4g93","id":"tcs_01M5KG5R6B30JBSKF3P1C5F76D","modified_at":"2026-10-07T16:30:06.349887482Z","published_at":"2026-10-07T16:14:35Z","references":["https://osv.dev/vulnerability/GHSA-q9mq-245r-4g93","https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93","https://nvd.nist.gov/vuln/detail/CVE-2026-106109","https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1","https://github.com/quasarframework/quasar","https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0"],"severity":{"label":"medium","score":4.1},"sources":[{"source":"osv","source_id":"GHSA-q9mq-245r-4g93","url":"https://osv.dev/vulnerability/GHSA-q9mq-245r-4g93"},{"source":"nvd","source_id":"CVE-2026-106109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106109"}],"summary":"Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories"}