CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

EUVD-2026-58189

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

PT-2026-71723

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

Quasar: Prototype pollution in the extend() utility

Summary [email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend utility exported from the package root. When extendtrue, target, source is used for a deep merge, attacker-controlled object keys are recursively...