CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility
Attackers can pollute Object.prototype via the extend utility, leading to code execution or denial of service in applications using Quasar Framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73647?
CVE-2026-73647 is a medium-severity code injection vulnerability in quasarframework quasar, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.
Weakness: CWE-1321
Which versions are affected by CVE-2026-73647?
2 open source packages ship an affected version, including quasar.
| Package | Affected | Fixed in |
|---|---|---|
quasar npm | All versions | 2.22.0 |
quasar npm | All versions | 2.22.0 |
How do I fix CVE-2026-73647?
Upgrade quasar to 2.22.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73647 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73647 exists.
Sources
Also known as GHSA-3r53-75j5-3g7j.