{"id":"CVE-2026-73647","aliases":["GHSA-3r53-75j5-3g7j"],"url":"https://o3.security/vulnerability/CVE-2026-73647","summary":"Quasar Framework: Prototype pollution in Quasar extend() utility","details":"Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.","published":"2026-08-13T17:57:09.014Z","modified":"2026-08-14T04:03:16.726322439Z","cvss":{"score":5.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"quasar","fixedVersion":"2.22.0"}],"fix":{"url":"https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7","label":"quasarframework/quasar@d0a95d9"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73647.json"},{"type":"FIX","url":"https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"},{"type":"WEB","url":"https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"},{"type":"ADVISORY","url":"https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73647"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-14T04:03:16.726322439Z"}}