Prototype Pollution Vulnerability in Quasar Package
Summary
GHSA-3r53-75j5-3g7j: Quasar: Prototype pollution in the extend() utility. Affects quasar versions < 2.22.0. Fixed in 2.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quasar is a popular open-source framework designed for building responsive web applications using Vue.js. It provides a rich set of UI components and utilities that streamline the development process. However, the package has been identified to have a vulnerability in its extend() utility, which can lead to prototype pollution, allowing attackers to manipulate the JavaScript prototype chain.
Vulnerability Detail
The vulnerability arises from the extend(true, target, source) method in Quasar, which performs a deep merge of objects. When this method is called with a user-controlled source object, it can inadvertently copy properties like __proto__, constructor, or prototype into the target object. This allows an attacker to modify Object.prototype, potentially leading to logic bypasses, unsafe default option injections, or denial of service in applications that rely on this functionality.
How To Fix
Latest published version: 2.35.2 as of 23 Oct 2026
npm install quasar@2.35.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.22.0
This is the first release that contains the fix.
npm install quasar@2.22.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the extend() method with user-controlled objects. Additionally, you can manually filter out dangerous keys before merging, as shown in the following code snippet:
const safeExtend = (target, source) => {
const safeKeys = Object.keys(source).filter(key => !['__proto__', 'constructor', 'prototype'].includes(key));
safeKeys.forEach(key => {
target[key] = source[key];
});
};
Conclusion
The prototype pollution vulnerability in the Quasar package can pose significant risks to applications that utilize the extend() utility. It is crucial to update to the patched version or implement workarounds to mitigate potential threats. Regular monitoring with tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for quasar →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of built-in objects in JavaScript, potentially leading to unexpected behavior in applications.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one.
If exploited, this vulnerability can lead to serious security issues such as logic bypasses, unsafe default options, and denial of service, depending on how the polluted properties are used in the application.
Yes, you can implement a custom merge function that filters out dangerous keys, as shown in the provided workaround code.
The CVSS score for this vulnerability is 5.6, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for quasar.
