{"vulnerability": "GHSA-3R53-75J5-3G7J", "sightings": [{"uuid": "b3a0cc96-5d32-40fd-be5f-1387c7933c64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3R53-75J5-3G7J", "type": "seen", "source": "https://gist.github.com/alon710/31362352a2fade2501771882d0062b85", "content": "# GHSA-3R53-75J5-3G7J: GHSA-3r53-75j5-3g7j: Prototype Pollution in Quasar Framework extend Utility\n\n> **CVSS Score:** 5.6\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-3R53-75J5-3G7J\n\n## Summary\nA prototype pollution vulnerability (CWE-1321) in the Quasar framework's utility function 'extend' allows unauthenticated remote attackers to modify the global Object.prototype. This vulnerability can lead to application-level logic bypasses, denial of service, or potentially arbitrary code execution depending on downstream implementation.\n\n## TL;DR\nA recursive object merge flaw in Quasar's 'extend' utility allows attackers to pollute Object.prototype via '__proto__' injection, risking arbitrary code execution or application bypasses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Base Score**: 5.6\n- **Impact**: Low Integrity, Low Confidentiality, Low Availability\n- **Exploit Status**: Proof-of-concept available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Web applications built using Quasar Framework npm package\n- Node.js server-side configurations employing Quasar extend utilities\n- **quasar**: < 2.22.0 (Fixed in: `2.22.0`)\n\n## Mitigation\n\n- Upgrade Quasar Framework npm package to version 2.22.0 or higher\n- Implement inputs validation to filter or sanitize keys like __proto__, constructor, and prototype\n- Freeze the global Object prototype using Object.freeze(Object.prototype) in secure environments\n\n**Remediation Steps:**\n1. Locate package.json and identify the quasar dependency\n2. Run 'npm install quasar@2.22.0' or 'yarn upgrade quasar@2.22.0'\n3. Verify that the application's lockfile resolves to the patched version\n4. Audit any direct or indirect usages of the 'extend' utility function in the source code\n\n## References\n\n- [GitHub Security Advisory GHSA-3r53-75j5-3g7j](https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j)\n- [Remediation Commit](https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7)\n- [Quasar Framework GitHub Repository](https://github.com/quasarframework/quasar)\n- [Release Notes v2.22.0](https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0)\n- [Snyk Vulnerability Database Reference](https://security.snyk.io/package/npm/quasar)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-3R53-75J5-3G7J) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T06:31:04.273103Z"}]}