Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins.
No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation to influence build configuration, or a developer to run a mistaken configuration. This issue is fixed in version 3.3.0.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
High
Admin privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
@quasar:app-vite
quasarframework:quasar
References 3
https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g…
https://github.com/quasarframework/quasar/security/advisories/GHSA-q9mq-245r-4g93
https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a8…
https://github.com/quasarframework/quasar/commit/6c009734b406e246a0855ed060e3a822de8aecc1
https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0
https://github.com/quasarframework/quasar/releases/tag/@quasar/app-vite-v3.3.0