CVE-2026-73647

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-73647

The vulnerability CVE-2026-73647 affects Quasar Framework prior to version 2.22.0. The public extend() utility in ui/src/utils/extend/extend.js recursively copies attacker-controlled keys during deep merges (extend(true, target, source)) and does not reject an own proto property. This could cause...

CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

@bedrock/quasar (10.0.1), @cabloy/front-quasar (>=5.0.82, <=5.0.96) +10 more potentially affected by CVE-2026-73647 via quasar (>=2.0.0-beta.1, <=2.18.6)

quasar NPM version =2.0.0-beta.1, =5.0.82, =2.0.1, =0.1.1-beta.0, =1.0.25-alpha.11, =1.0.183, =1.0.0, =5.0.97, =5.0.215 Source cves: CVE-2026-73647 Source advisory: OSV:GHSA-3R53-75J5-3G7J...