Is CVE-2026-73647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73647 being exploited in the wild.

How severe is CVE-2026-73647?

Medium severity, with a CVSS score of 5.6, published 13 August 2026.

Which products and versions are affected?

quasar (npm) SEMVER:introduced=0,fixed=2.22.0.

Is there a fix for CVE-2026-73647?

Yes. quasar (npm): upgrade to 2.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73647 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73647?

Check whether you run quasar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73647: Quasar extend() utility prototype pollution

CVE-2026-73647 · Severity: medium · CVSS 5.6 · Published 2026-08-13

Quasar is a framework for building VueJS-based user interfaces. The extend() utility function, commonly used by developers to merge configuration objects, fails to sanitize dangerous prototype properties. An attacker who can influence data passed to extend(true, ...) can inject malicious properties into all JavaScript objects in the application, potentially bypassing security logic, injecting unsafe defaults, or causing denial of service.

Technologies: quasar (npm). Vendors: npm.

Quick answers

Is CVE-2026-73647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73647 being exploited in the wild.
How severe is CVE-2026-73647?: Medium severity, with a CVSS score of 5.6, published 13 August 2026.
Which products and versions are affected?: quasar (npm) SEMVER:introduced=0,fixed=2.22.0.
Is there a fix for CVE-2026-73647?: Yes. quasar (npm): upgrade to 2.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73647 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73647?: Check whether you run quasar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

quasar (npm): upgrade to 2.22.0 or later
```
npm install quasar@2.22.0
```

Technical details

This is a prototype pollution vulnerability (CWE-1321) in Quasar's extend.js utility. The vulnerability exists because the deep merge implementation recursively assigns source object keys into the target without filtering dangerous keys such as __proto__, prototype, or constructor. When a source object contains an own __proto__ property, the recursive merge descends into the prototype object and writes attacker-controlled properties onto Object.prototype. The vulnerability requires no authentication and can be triggered via the network if user input reaches the extend() call. An attacker can pollute Object.prototype with arbitrary properties, potentially causing downstream security issues depending on how those properties are consumed by the application. The fix, available in Quasar 2.22.0, rejects or safely ignores dangerous keys and avoids descending into prototype-related properties during recursive merge.

Affected products

Quasar Framework Quasar <= 2.21.4

Identifiers

CVE-2026-73647
GHSA-3r53-75j5-3g7j

Timeline

2026-07-24: disclosed
2026-07-21: patched: Fix released in Quasar 2.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.