The Quasar package (npm) exports an extend() utility that performs deep merging of objects. In versions prior to 2.22.0, when extend(true, target, source) is called, the function recursively copies keys from the source to the target without filtering out prototype-pollution primitives like __proto__, constructor, or prototype. This allows an attacker to inject properties into Object.prototype, affecting all objects in the JavaScript environment. The vulnerability is demonstrated by a proof-of-concept where extend() is used to add a 'polluted' property to Object.prototype, which then appears on all objects. The suggested fix is to reject or ignore dangerous keys and avoid descending into prototype-related properties during the merge.

If an application uses extend(true, ...) with user-controlled or partially user-controlled input, an attacker can modify Object.prototype properties. This may cause logic bypass, unsafe default option injection, denial of service, or other application-specific security issues depending on how the polluted properties are consumed. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or user-controlled objects to extend(true, ...). Implement input validation to exclude prototype-pollution keys such as __proto__, constructor, and prototype before merging. Monitor vendor channels for an official fix or update to Quasar version 2.22.0 or later once released.