The issue arises from @quasar/app-vite’s recursive deletion of the resolved build.distDir before compiling. Because the cleanup omits checks against the project root, user home, filesystem roots, or symlink‑resolved external directories, an unsafe configuration can delete any data writable by the build user. By default, attacker‑controlled input does not reach build.distDir; exploitation therefore requires a compromised or less‑trusted build environment or a developer mistake that sets an unsafe output directory.

This flaw affects the Quasar Framework’s @quasar/app‑vite component, which was released from versions 1.0.0 through 3.3.0. The safety fix that removes the recursive cleanup is available in @quasar/app‑vite v3.3.0 and later.

The CVSS score of 4.1 indicates low to moderate severity, and the vulnerability is not listed in CISA KEV. EPSS is not available, suggesting no substantial evidence of widespread exploitation. Attack vectors are limited to local or automated build systems, so remote exploitation is unlikely. The primary risk stems from accidental or malicious misconfiguration of build.distDir that could result in data loss. Despite the low score, administrators should update to the fixed version promptly to avoid unintended file deletion.