Executive brief
Quasar is a framework for building VueJS-based user interfaces. The extend() utility function, commonly used by developers to merge configuration objects, fails to sanitize dangerous prototype properties. An attacker who can influence data passed to extend(true, ...) can inject malicious properties into all JavaScript objects in the application, potentially bypassing security logic, injecting unsafe defaults, or causing denial of service.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in Quasar's extend.js utility. The vulnerability exists because the deep merge implementation recursively assigns source object keys into the target without filtering dangerous keys such as __proto__, prototype, or constructor. When a source object contains an own __proto__ property, the recursive merge descends into the prototype object and writes attacker-controlled properties onto Object.prototype. The vulnerability requires no authentication and can be triggered via the network if user input reaches the extend() call. An attacker can pollute Object.prototype with arbitrary properties, potentially causing downstream security issues depending on how those properties are consumed by the application. The fix, available in Quasar 2.22.0, rejects or safely ignores dangerous keys and avoids descending into prototype-related properties during recursive merge.
Affected products
- Quasar Framework Quasar <= 2.21.4
Timeline
- 2026-07-24: disclosed
- 2026-07-21: patched: Fix released in Quasar 2.22.0