fkie_cve-2026-73647

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

GHSA-3r53-75j5-3g7j — Quasar: Prototype pollution in the extend() utility

Affected: npm: quasar

### Summary

`quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root.

When `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as `__proto__`, `constructor`, or `prototype`.

This can allow attacker-controlled properties to be written to `Object.prototype`.

### Details

Affected source:

```text src/utils/extend/extend.js ```

Distributed files include:

```text dist/quasar.server.prod.js dist/quasar.server.prod.cjs dist/quasar.client.js ```

The package root publicly exports `extend`. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own `__proto__` property, the merge can descend into the prototype object and assign attacker-controlled properties onto `Object.prototype`.

### PoC

```bash rm -rf /tmp/quasar-extend-pp-poc mkdir /tmp/quasar-extend-pp-poc cd /tmp/quasar-extend-pp-poc

npm init -y >/dev/null npm install quasar@2.20.1 vue@3.5.31 >/dev/null

cat > hack.mjs <<'JS' import { extend } from 'quasar';

delete Object.prototype.polluted;

extend(true, {}, { ['__proto__']: { polluted: 'yes' } });

console.log(({}).polluted);

delete Object.prototype.polluted; JS

node ./hack.mjs ```

Observed output:

```text yes ```

Expected out…

Most recent entries from all

fkie_cve-2026-73647

GHSA-3r53-75j5-3g7j — Quasar: Prototype pollution in the extend() utility