Prototype Pollution in Quasar Framework Affects Vue.js User Interfaces

CVE-2026-73647

What is CVE-2026-73647?

The Quasar Framework, designed for building high-performance Vue.js user interfaces, has a vulnerability where the public extend() utility can be exploited. Before version 2.22.0, the method allowed attacker-controlled object keys to be recursively copied during deep merges, potentially affecting applications that utilize partially user-controlled objects. Specifically, due to the lack of proper checks on the proto property, attackers could manipulate Object.prototype. This situation could lead to various issues such as logic bypasses, unsafe default-option injections, denial of service, or other application-specific impacts when the injected properties were subsequently accessed. The issue has been resolved in version 2.22.0.

References