VulnerabilityPublished 07/24/2026

Quasar: Prototype pollution in the extend() utility

Affects quasarSource GCVE Database

CVSS 3.1 base score

5.6Medium

Patch: Available – fixed in 2.22.0

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or user-controlled objects to extend(true, ...). Implement input validation to exclude prototype-pollution keys such as __proto__, constructor, and prototype before merging. Monitor vendor channels for an official fix or update to Quasar version 2.22.0 or later once released.

Affected software

Product	Affected	Fixed in
npmquasar	Affected <2.22.0	Fixed in 2.22.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Quasar version 2.20.1 and earlier are vulnerable to prototype pollution via the public extend() utility. The vulnerability occurs during deep merge operations where attacker-controlled keys such as __proto__, constructor, or prototype are not blocked, allowing modification of Object.prototype. This can lead to application-specific impacts such as logic bypass or denial of service if polluted properties are used unsafely.

Summary

The Quasar package (npm) exports an extend() utility that performs deep merging of objects. In versions prior to 2.22.0, when extend(true, target, source) is called, the function recursively copies keys from the source to the target without filtering out prototype-pollution primitives like __proto__, constructor, or prototype. This allows an attacker to inject properties into Object.prototype, affecting all objects in the JavaScript environment. The vulnerability is demonstrated by a proof-of-concept where extend() is used to add a 'polluted' property to Object.prototype, which then appears on all objects. The suggested fix is to reject or ignore dangerous keys and avoid descending into prototype-related properties during the merge.

Impact

If an application uses extend(true, ...) with user-controlled or partially user-controlled input, an attacker can modify Object.prototype properties. This may cause logic bypass, unsafe default option injection, denial of service, or other application-specific security issues depending on how the polluted properties are consumed. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Weaknesses

CWE-1321Unclassified weakness (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:49:07 UTC

Technical details

Weaknesses

References

Related threats