EUVD-2026-58189
GHSA-3r53-75j5-3g7j
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
AV:N because payload is delivered over the network; AC:H because exploitation requires a specific application code path exposing extend() to user input; PR:N and UI:N confirmed by PoC; S:U because pollution stays within the same JS process; C/I/A all L reflecting indirect, application-dependent impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
AnalysisAI
Prototype pollution in Quasar Framework's public extend() utility (npm package quasar, versions <= 2.21.4) allows attacker-controlled properties to be written to Object.prototype when applications pass user-controlled objects into deep merge calls. The flaw exists because extend(true, target, source) recursively copies source keys including __proto__ without rejection, enabling descent into the prototype chain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application passes user-controlled or partially user-controlled objects to Quasar's extend() function in deep-merge mode - specifically, the call signature extend(true, target, source) where source contains attacker-supplied keys. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) correctly captures the tension in this vulnerability: while no authentication or user interaction is required at the network level, the AC:H rating reflects the critical real-world constraint - exploitation succeeds only when application code passes user-controlled or partially user-controlled data directly to extend(true, ...) without prior sanitization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted JSON body to an application endpoint - such as a configuration import, merge-patch, or user-preferences API - containing a key literally named __proto__ with a nested object of injected properties. When the server-side code passes this deserialized object to extend(true, target, source), the merge recursively writes the injected properties onto Object.prototype, causing every subsequent plain object in the process to inherit them. … |
| Remediation | Upgrade the quasar npm package to version 2.22.0 or later; this is the vendor-confirmed fix per the GitHub release at https://github.com/quasarframework/quasar/releases/tag/quasar-v2.22.0 and the advisory at https://github.com/quasarframework/quasar/security/advisories/GHSA-3r53-75j5-3g7j. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today