Vulnerability-Lookup

CVE-2026-73647 (GCVE-0-2026-73647)

Vulnerability from cvelistv5 – Published: 2026-08-13 17:57 – Updated: 2026-08-13 18:41

Title

Quasar Framework: Prototype pollution in Quasar extend() utility

Summary

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 18:41 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/quasarframework/quasar/securit…	x_refsource_CONFIRM
https://github.com/quasarframework/quasar/commit/…	x_refsource_MISC
https://github.com/quasarframework/quasar/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
quasarframework	quasar	Affected: < 2.22.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73647",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T18:41:13.711876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T18:41:21.421Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T17:57:09.014Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
        },
        {
          "name": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
        },
        {
          "name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3r53-75j5-3g7j",
        "discovery": "UNKNOWN"
      },
      "title": "Quasar Framework: Prototype pollution in Quasar extend() utility"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73647",
    "datePublished": "2026-08-13T17:57:09.014Z",
    "dateReserved": "2026-08-13T14:04:09.604Z",
    "dateUpdated": "2026-08-13T18:41:21.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73647",
      "date": "2026-09-18",
      "epss": "0.0038",
      "percentile": "0.31885"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "quasar",
                "vendor": "quasarframework",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.22.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0."
          }
        ],
        "id": "CVE-2026-73647",
        "lastModified": "2026-09-09T21:02:22.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73647",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T18:41:13.711876Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T18:18:20.450",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1321"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73647",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T18:41:13.711876Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T18:40:58.763Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "quasar",
              "vendor": "quasarframework",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.22.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1321",
                  "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T17:57:09.014Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
            },
            {
              "name": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
            },
            {
              "name": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
            }
          ],
          "source": {
            "advisory": "GHSA-3r53-75j5-3g7j",
            "discovery": "UNKNOWN"
          },
          "title": "Quasar Framework: Prototype pollution in Quasar extend() utility"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73647",
        "datePublished": "2026-08-13T17:57:09.014Z",
        "dateReserved": "2026-08-13T14:04:09.604Z",
        "dateUpdated": "2026-08-13T18:41:21.421Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73647

Vulnerability from fkie_nvd - Published: 2026-08-13 18:18 - Updated: 2026-09-09 21:02

Severity

5.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7
	security-advisories@github.com	https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0
	security-advisories@github.com	https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "quasar",
          "vendor": "quasarframework",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.22.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0."
    }
  ],
  "id": "CVE-2026-73647",
  "lastModified": "2026-09-09T21:02:22.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73647",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-13T18:41:13.711876Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T18:18:20.450",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3R53-75J5-3G7J

Vulnerability from github – Published: 2026-07-24 22:36 – Updated: 2026-08-13 17:57

Summary

Quasar: Prototype pollution in the extend() utility

Details

Summary

quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root.

When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as __proto__, constructor, or prototype.

This can allow attacker-controlled properties to be written to Object.prototype.

Details

Affected source:

src/utils/extend/extend.js

Distributed files include:

dist/quasar.server.prod.js
dist/quasar.server.prod.cjs
dist/quasar.client.js

The package root publicly exports extend. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own __proto__ property, the merge can descend into the prototype object and assign attacker-controlled properties onto Object.prototype.

PoC

rm -rf /tmp/quasar-extend-pp-poc
mkdir /tmp/quasar-extend-pp-poc
cd /tmp/quasar-extend-pp-poc

npm init -y >/dev/null
npm install quasar@2.20.1 vue@3.5.31 >/dev/null

cat > hack.mjs <<'JS'
import { extend } from 'quasar';

delete Object.prototype.polluted;

extend(true, {}, {
  ['__proto__']: {
    polluted: 'yes'
  }
});

console.log(({}).polluted);

delete Object.prototype.polluted;
JS

node ./hack.mjs

Observed output:

yes

Expected output:

undefined

Impact

This is a prototype pollution vulnerability.

If an application passes user-controlled or partially user-controlled objects into extend(true, ...), an attacker may be able to pollute Object.prototype in the same JavaScript process.

Depending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.

Suggested Fix

Reject or safely ignore dangerous keys before assignment, including:

__proto__
prototype
constructor

The merge implementation should also avoid descending into prototype-related properties during recursive merge.

Severity

5.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.21.4"
      },
      "package": {
        "ecosystem": "npm",
        "name": "quasar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73647"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:36:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public `extend()` utility exported from the package root.\n\nWhen `extend(true, target, source)` is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as `__proto__`, `constructor`, or `prototype`.\n\nThis can allow attacker-controlled properties to be written to `Object.prototype`.\n\n### Details\n\nAffected source:\n\n```text\nsrc/utils/extend/extend.js\n```\n\nDistributed files include:\n\n```text\ndist/quasar.server.prod.js\ndist/quasar.server.prod.cjs\ndist/quasar.client.js\n```\n\nThe package root publicly exports `extend`. During deep merge, source object keys are recursively assigned into the target object. If the source object contains an own `__proto__` property, the merge can descend into the prototype object and assign attacker-controlled properties onto `Object.prototype`.\n\n### PoC\n\n```bash\nrm -rf /tmp/quasar-extend-pp-poc\nmkdir /tmp/quasar-extend-pp-poc\ncd /tmp/quasar-extend-pp-poc\n\nnpm init -y \u003e/dev/null\nnpm install quasar@2.20.1 vue@3.5.31 \u003e/dev/null\n\ncat \u003e hack.mjs \u003c\u003c\u0027JS\u0027\nimport { extend } from \u0027quasar\u0027;\n\ndelete Object.prototype.polluted;\n\nextend(true, {}, {\n  [\u0027__proto__\u0027]: {\n    polluted: \u0027yes\u0027\n  }\n});\n\nconsole.log(({}).polluted);\n\ndelete Object.prototype.polluted;\nJS\n\nnode ./hack.mjs\n```\n\nObserved output:\n\n```text\nyes\n```\n\nExpected output:\n\n```text\nundefined\n```\n\n### Impact\n\nThis is a prototype pollution vulnerability.\n\nIf an application passes user-controlled or partially user-controlled objects into `extend(true, ...)`, an attacker may be able to pollute `Object.prototype` in the same JavaScript process.\n\nDepending on how the polluted property is later consumed, this may lead to logic bypass, unsafe default option injection, denial of service, or other application-specific security impact.\n\n### Suggested Fix\n\nReject or safely ignore dangerous keys before assignment, including:\n\n```text\n__proto__\nprototype\nconstructor\n```\n\nThe merge implementation should also avoid descending into prototype-related properties during recursive merge.",
  "id": "GHSA-3r53-75j5-3g7j",
  "modified": "2026-08-13T17:57:16Z",
  "published": "2026-07-24T22:36:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/commit/d0a95d95ab3c29d13e1b8ba8c5e5025fd6ce35e7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quasarframework/quasar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quasar: Prototype pollution in the extend() utility"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73647 (GCVE-0-2026-73647)

FKIE_CVE-2026-73647

GHSA-3R53-75J5-3G7J

Summary

Details

PoC

Impact

Suggested Fix

Tags

Sightings

Nomenclature

Related by attack behaviour