AIKIDO-2026-552145

TL;DR

@quasar/app-vite recursively removes the configured build.distDir before writing build artifacts. The resolved path is made absolute but is not validated, and existing symlink ancestors are not resolved, so a misconfigured or externally influenced output directory can point outside the project. Running a normal build can then delete data outside the intended output tree with the permissions of the build user. The fix validates the deletion target, rejects filesystem roots, the home directory and the project root, resolves symlink ancestors, and requires an explicit opt-in for external output directories.