Quasar Framework prototype pollution in extend utility

Executive brief

The Quasar Framework, a popular tool for building web and mobile applications, contains a flaw in its data-merging utility. If an application uses this utility to process data provided by a user, an attacker could potentially inject malicious properties into the application's memory. This can lead to unexpected behavior, such as bypassing security logic, causing the application to crash, or altering how the application handles data.

Technical details

A prototype pollution vulnerability exists in the `extend()` utility of the Quasar Framework (specifically in `src/utils/extend/extend.js`). When the utility is called with the deep merge flag (`true`), it recursively copies properties from a source object to a target object without sanitizing sensitive keys like `__proto__`, `constructor`, or `prototype`. An attacker who can provide a specially crafted object to this function can modify `Object.prototype`, potentially leading to denial of service, logic bypass, or remote code execution depending on the application's environment. The issue is fixed in version 2.22.0.

Affected products

• Quasar Framework Quasar <= 2.21.4

Timeline

• 2026-07-23: disclosed
• 2026-07-24: advisory: GHSA-3r53-75j5-3g7j published
• 2026-07-24: patched: Fixed in version 2.22.0

References

• https://api.github.com/users/Dremig
• https://github.com/Dremig
• https://api.github.com/users/Dremig/gists%7B/gist_id%7D
• https://api.github.com/users/Dremig/repos
• https://avatars.githubusercontent.com/u/145779217?v=4
• https://api.github.com/users/Dremig/events%7B/privacy%7D