Description

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-08-13T18:18:20.450Z",
  "pubdate": "2026-08-13T18:18:20.450Z",
  "executiveSummary": "A prototype pollution vulnerability exists in the Quasar Framework prior to version 2.22.0. The vulnerability resides in the public extend() utility located within ui/src/utils/extend/extend.js, which fails to properly validate and reject the own __proto__ property during recursive deep merge operations executed via extend(true, target, source).\nAn attacker capable of controlling or influencing input objects passed to the extend() utility can manipulate the JavaScript prototype chain, injecting arbitrary properties directly into Object.prototype within the runtime environment of the affected application process.\nThe resulting impact varies based on how application logic consumes the polluted properties, potentially resulting in logic bypasses, unsafe default-option injection, denial of service conditions, or other application-specific security consequences.\nExploitation requires the application to process user-controlled or partially user-controlled data using the vulnerable deep merge utility without adequate input sanitization or validation.",
  "technicalDetails": "The vulnerability stems from improper input handling during deep copy and merge operations within the public extend() utility at ui/src/utils/extend/extend.js in the Quasar Framework.\nWhen invoked with deep merge parameters via extend(true, target, source), the utility recursively iterates through the keys of the source object to copy properties into the target object. The implementation fails to filter or restrict the traversal of dangerous object keys, specifically the __proto__ property.\nBy supplying a crafted object payload containing an explicit __proto__ key, an attacker forces the recursive merging mechanism to descend into the prototype object rather than standard object properties.\nConsequently, the assignment operation writes attacker-controlled keys and values directly into Object.prototype, affecting every object instance sharing the same prototype chain within the active JavaScript runtime process.\nAffected versions include all Quasar Framework installations prior to version 2.22.0.\nThe attack vector involves passing user-influenced or entirely user-controlled data structures into the vulnerable extend() function.\nPost-exploitation impact manifests when subsequent application logic processes objects that inherit the polluted properties, leading to altered control flow, corrupted default options, or application instability."
}