Threat Intelligence Database

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, target, source) deep merges without rejecting an own __proto__ property. The merge could descend into the prototype object and write attacker-controlled properties to Object.prototype in the same JavaScript process. Applications that passed user-controlled or partially user-controlled objects to extend() could experience logic bypass, unsafe default-option injection, denial of service, or other application-specific impact when polluted properties were later consumed. This issue is fixed in version 2.22.0.

Quasar version 2.20.1 and earlier are vulnerable to prototype pollution via the public extend() utility. The vulnerability occurs during deep merge operations where attacker-controlled keys such as __proto__, constructor, or prototype are not blocked, allowing modification of Object.prototype. This can lead to application-specific impacts such as logic bypass or denial of service if polluted properties are used unsafely.