CVE-2026-73647

The vulnerability CVE-2026-73647 affects Quasar Framework prior to version 2.22.0. The public extend() utility in ui/src/utils/extend/extend.js recursively copies attacker-controlled keys during deep merges (extend(true, target, source)) and does not reject an own proto property. This could cause...

PT-2026-71723

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-73647: Improperly Controlled Modification of Object Prototype Attributes

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

EUVD-2025-122973

Malicious code in quasar-framework-superagent-remark npm...

EUVD-2025-113420

Malicious code in framework-quasar-spawn-commitlint-config-angular npm...

MAL-2025-146949 Malicious code in quasar-framework-superagent-remark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccdd639f51defd668b7f6948d0f440c9f2a0d4f64fb0987703f3cdc9251fc2b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...