AIKIDO-2026-552145
@quasar/app-vite is vulnerable to Path Traversal
47
Medium Risk
This Affects:
@quasar/app-viteTL;DR
@quasar/app-vite recursively removes the configured build.distDir before writing build artifacts. The resolved path is made absolute but is not validated, and existing symlink ancestors are not resolved, so a misconfigured or externally influenced output directory can point outside the project. Running a normal build can then delete data outside the intended output tree with the permissions of the build user. The fix validates the deletion target, rejects filesystem roots, the home directory and the project root, resolves symlink ancestors, and requires an explicit opt-in for external output directories.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your build.distDir is misconfigured or generated by less-trusted automation so that it can resolve outside the project.
Background info
@quasar/app-vite is vulnerable to Path Traversal in versions 1.0.0 - 3.2.0.
How to fix this
Upgrade the @quasar/app-vite library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant