CVE-2026-73647

Name of the Vulnerable Software and Affected Versions Quasar Framework versions prior to 2.22.0

Description The public extend() function in ui/src/utils/extend/extend.js performs deep merges by recursively copying object keys. When extend(true, target, source) is used, the utility fails to reject the proto property. This allows an attacker to inject controlled properties into Object.prototype within the JavaScript process, a technique known as prototype pollution. Applications passing user-controlled objects to this function may suffer from logic bypass, unsafe default-option injection, or denial of service.

Recommendations Update to version 2.22.0. As a temporary mitigation, avoid passing user-controlled or partially user-controlled objects to the extend() function.